On Sun, Mar 07, 2010 at 07:39:59PM +0530, Varrun Ramani wrote: > Hi > > I am right now undertaking a project which deals with verification of > firewall rules. I wish to know which applications/libraries modify/query > firewall rules. I came to know that libvirt modifies iptables rules. Can > anyone let me know for what purposes/how libvirt modifies the rules? The 'virtual network' functionality in libvirt sets up a isolated bridge device, to which guests are connected. libvirt uses iptables to control what happens to traffic on that bridge device. Either we stop it leaving the bridge entirely (only VM<->VM and VM<->host), or allow it to get to the LAN either routing a subnet, or using NAT to masquerade it. The rules are written such that they only match traffic relating to the configured bridge device in libvirt, so they shouldn't expose the rest of the host interfaces to any new traffic risks Regards, Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list