On Thu, Mar 27, 2008 at 03:35:54PM -0500, Charles Duffy wrote: > Daniel P. Berrange wrote: > >Instead of having the separate ACCEPT rule I think it would be sufficient > >to replace the 0.0.0.0/0 target with ! 192.168.65.0/24, eg > > > >iptables -t nat -A POSTROUTING > > --source 192.168.65.0/24 > > --destination ! 192.168.65.0/24 > > -j MASQUERADE > > > >so it will masquerade traffic which is leaving the ip range of the virtual > >network only, and leave ip traffic between the VMs & VM<->host alone. > > I considered that -- but while it will work as long as the default > forward rule is ACCEPT, it could result in hosts being unable to > communicate with each other if the default rule for the table is otherwise. > > That said, it's certainly easier... patch attached. I've applied this patch to CVS, Regards, Dan. -- |: Red Hat, Engineering, Boston -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :| -- Libvir-list mailing list Libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list