firewalld version 1.3.0-1
libvirt version 9.0.0-4
network-manager version 1.42.4-1
# firewall-cmd --get-active-zones
libvirt
interfaces: br28
public
interfaces: dac0 dac0.100 dac0.28 ftth
# firewall-cmd --list-all --zone=public
public (active)
target: default
icmp-block-inversion: no
interfaces: dac0 dac0.100 dac0.28 ftth
sources:
services: dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
dac0 is a Direct Attach cable with several vlans.
dac0.100 is the vlan where I create the ppoe connection from my FTTH
provider.
ftth is the ppp name.
dac0.28 is the vlan for the public /28 IPv4 subnet.
br28 is the bridge where dac0.28 is attached.
# brctl show
bridge name bridge id STP enabled interfaces
br28 8000.d2605c025b1d no dac0.28
vnet1
# firewall-cmd --list-all --zone=libvirt
libvirt (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: br28
sources:
services: dhcp dhcpv6 dns ssh tftp
ports:
protocols: icmp ipv6-icmp
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule priority="32767" reject
# nft list tables
table inet firewalld
table ip mangle
# nft list table ip mangle
# Warning: table ip mangle is managed by iptables-nft, do not touch!
table ip mangle {
chain FORWARD {
type filter hook forward priority mangle; policy accept;
oifname "ftth" tcp flags syn / syn,rst tcp option maxseg size
1400-65495 counter packets 0 bytes 0 tcp option maxseg size set rt mtu
}
}
The previous rule is created by NetworkManager to clamp-mss-to-pmtu for
the ftth pppoe.
This is how I create the bridge and the dac0.28 vlan with
NetworkManager:
# nmcli con add ifname br28 type bridge con-name br28 ipv4.method manual
ipv4.addresses MY_IP/28 connection.zone libvirt
# nmcli connection add type vlan con-name dac0.28 ifname dac0.28
vlan.parent dac0 vlan.id 28 ipv4.method disabled ipv6.method disabled
master br28 slave-type bridge
I also have isc-dhcp-server, wide-dhcpv6-client and radvd running.
# nmcli con
NAME UUID TYPE DEVICE
ftth f370639c-2712-49c2-9749-e39f17102346 pppoe ftth
br28 e4d2aad3-ef2d-4ac0-bda5-58471f21655c bridge br28
lo f0327b03-bbc3-4078-8bd1-5225df0ce153 loopback lo
vnet1 25ae75cd-1606-4fd7-8213-09f4ef1280c4 tun vnet1
dac0 040e747e-fd7e-41e9-b6a6-ccec9e73c022 ethernet dac0
dac0.100 147c1632-2c60-42f3-a97a-a6733ef69f4c vlan dac0.100
dac0.28 cefb4bf3-dda9-465a-95d0-512ac1294a5b vlan dac0.28
enp1s0 81a44a95-efdc-47e2-9c12-76a0a140ca5a ethernet --
The previous are all dark green expect lo and vnet1 which are light
green (externally managed) and enp1s0 which is white (disconnected).
The br_netfilter module is not loaded and thus
net.bridge.bridge-nf-call-ip6tables, net.bridge.bridge-nf-call-iptables,
net.bridge.bridge-nf-call-arptables are not even exposed to
/proc/sys/net/bridge.
I don't have any nwfilter enabled yet, I'd like to get the basics
working first.
The guest gets an IP (both v4 and v6) and can reach the internet.
Unfortunately the guest cannot be reached from the outside:
$ ping GUEST_IP
PING GUEST_IP (GUEST_IP) 56(84) bytes of data.
From FTTH_IP icmp_seq=1 Packet filtered
$ ssh GUEST_IP
ssh: connect to host GUEST_IP port 22: No route to host
Routed networking works fine, but libvirt is in charge to create
everything in that case (creating the bridge, assigning the
libvirt-routed zone, enabling the libvirt-routed policies, etc) while
bridged networking must be configured manually (at least on non-RedHat
distros).
What's wrong? It looks suspiciously similar to
https://bbs.archlinux.org/viewtopic.php?id=274670
Thanks,
Niccolo' Belli
