On Sun, 2019-11-17 at 21:03 +0100, Tom H wrote: > On Sun, Nov 17, 2019 at 10:14 AM Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote: > > On 11/17/19 5:07 PM, Tom H wrote: > > > On Sun, Nov 17, 2019 at 1:49 AM Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote: > > > > I put the interface virbr0 in the FW zone libvirt. > > > > > > Wow. Weird that virbr0 is firewalled, but good to know. Thanks. > > > > Yep, and as my other post states I think it always was there. If > > one reads the description in > > /usr/lib/firewalld/zones/libvirt.xml they'd see. > > > > <description> > > The default policy of "ACCEPT" allows all packets to/from > > interfaces in the zone to be forwarded, while the (*low priority*) > > reject rule blocks any traffic destined for the host, except those > > services explicitly listed (that list can be modified as required > > by the local admin). This zone is intended to be used only by > > libvirt virtual networks - libvirt will add the bridge devices for > > all new virtual networks to this zone by default. > > </description> > > Thanks. I assume that you didn't just add virbr0 to the libvirt zone, > but that you also added the three nfs-related services to this zone. Of course. Note that virbr0 was already in the libvirt zone. I didn't add it explicitly as far as I can recall. In fact I did notice that whenever a VM started up (via virt-manager) I got a popup from the firewall applet to say that virbr0 was in the libvirt zone, but the applet itself always incorrectly showed virbr0 in my default zone (home) as Ed has already mentioned. > Comment from the libvirt source > > /* if firewalld is active, try to set the "libvirt" zone. This is > * desirable (for consistency) if firewalld is using the iptables > * backend, but is necessary (for basic network connectivity) if > * firewalld is using the nftables backend > */ > > So it's an nftables requirement. I've never heard of nftables. I assumed that iptables was the backend. poc _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
