On 11/18/19 4:03 AM, Tom H wrote: > On Sun, Nov 17, 2019 at 10:14 AM Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote: >> On 11/17/19 5:07 PM, Tom H wrote: >>> On Sun, Nov 17, 2019 at 1:49 AM Ed Greshko <ed.greshko@xxxxxxxxxxx> wrote: >>>> I put the interface virbr0 in the FW zone libvirt. >>> Wow. Weird that virbr0 is firewalled, but good to know. Thanks. >> Yep, and as my other post states I think it always was there. If >> one reads the description in >> /usr/lib/firewalld/zones/libvirt.xml they'd see. >> >> <description> >> The default policy of "ACCEPT" allows all packets to/from >> interfaces in the zone to be forwarded, while the (*low priority*) >> reject rule blocks any traffic destined for the host, except those >> services explicitly listed (that list can be modified as required >> by the local admin). This zone is intended to be used only by >> libvirt virtual networks - libvirt will add the bridge devices for >> all new virtual networks to this zone by default. >> </description> > Thanks. I assume that you didn't just add virbr0 to the libvirt zone, > but that you also added the three nfs-related services to this zone. But, of course. I thought I mentioned that I was manipulating the wrong zone due to being misled by a GUI. Oh, and my ignorance. :-) And, that on further review, virbr0 was always in the libvirt zone. > > Comment from the libvirt source > > /* if firewalld is active, try to set the "libvirt" zone. This is > * desirable (for consistency) if firewalld is using the iptables > * backend, but is necessary (for basic network connectivity) if > * firewalld is using the nftables backend > */ > > So it's an nftables requirement. Good to know... -- The key to getting good answers is to ask good questions. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
