mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 05:35:25 +00:00
397c0f4b01
This patch adds some previously missing test cases that test for proper firewall rule creation when the following are included in the network definition: * <forward dev='blah'> * no forward element (an "isolated" network) * nat port range when only ipv4 is nat-ed * nat port range when both ipv4 & ipv6 are nated Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Laine Stump <laine@redhat.com>
155 lines
2.7 KiB
Plaintext
155 lines
2.7 KiB
Plaintext
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_INP \
|
|
--in-interface virbr0 \
|
|
--protocol tcp \
|
|
--destination-port 67 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_INP \
|
|
--in-interface virbr0 \
|
|
--protocol udp \
|
|
--destination-port 67 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_OUT \
|
|
--out-interface virbr0 \
|
|
--protocol tcp \
|
|
--destination-port 68 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_OUT \
|
|
--out-interface virbr0 \
|
|
--protocol udp \
|
|
--destination-port 68 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_INP \
|
|
--in-interface virbr0 \
|
|
--protocol tcp \
|
|
--destination-port 53 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_INP \
|
|
--in-interface virbr0 \
|
|
--protocol udp \
|
|
--destination-port 53 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_OUT \
|
|
--out-interface virbr0 \
|
|
--protocol tcp \
|
|
--destination-port 53 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_OUT \
|
|
--out-interface virbr0 \
|
|
--protocol udp \
|
|
--destination-port 53 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_FWO \
|
|
--in-interface virbr0 \
|
|
--jump REJECT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_FWI \
|
|
--out-interface virbr0 \
|
|
--jump REJECT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_FWX \
|
|
--in-interface virbr0 \
|
|
--out-interface virbr0 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_FWO \
|
|
--source 192.168.122.0/24 \
|
|
--in-interface virbr0 \
|
|
--out-interface enp0s7 \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table filter \
|
|
--insert LIBVIRT_FWI \
|
|
--destination 192.168.122.0/24 \
|
|
--in-interface enp0s7 \
|
|
--out-interface virbr0 \
|
|
--match conntrack \
|
|
--ctstate ESTABLISHED,RELATED \
|
|
--jump ACCEPT
|
|
iptables \
|
|
-w \
|
|
--table nat \
|
|
--insert LIBVIRT_PRT \
|
|
--source 192.168.122.0/24 '!' \
|
|
--destination 192.168.122.0/24 \
|
|
--out-interface enp0s7 \
|
|
--jump MASQUERADE
|
|
iptables \
|
|
-w \
|
|
--table nat \
|
|
--insert LIBVIRT_PRT \
|
|
--source 192.168.122.0/24 \
|
|
-p udp '!' \
|
|
--destination 192.168.122.0/24 \
|
|
--out-interface enp0s7 \
|
|
--jump MASQUERADE \
|
|
--to-ports 1024-65535
|
|
iptables \
|
|
-w \
|
|
--table nat \
|
|
--insert LIBVIRT_PRT \
|
|
--source 192.168.122.0/24 \
|
|
-p tcp '!' \
|
|
--destination 192.168.122.0/24 \
|
|
--out-interface enp0s7 \
|
|
--jump MASQUERADE \
|
|
--to-ports 1024-65535
|
|
iptables \
|
|
-w \
|
|
--table nat \
|
|
--insert LIBVIRT_PRT \
|
|
--out-interface enp0s7 \
|
|
--source 192.168.122.0/24 \
|
|
--destination 255.255.255.255/32 \
|
|
--jump RETURN
|
|
iptables \
|
|
-w \
|
|
--table nat \
|
|
--insert LIBVIRT_PRT \
|
|
--out-interface enp0s7 \
|
|
--source 192.168.122.0/24 \
|
|
--destination 224.0.0.0/24 \
|
|
--jump RETURN
|
|
iptables \
|
|
-w \
|
|
--table mangle \
|
|
--insert LIBVIRT_PRT \
|
|
--out-interface virbr0 \
|
|
--protocol udp \
|
|
--destination-port 68 \
|
|
--jump CHECKSUM \
|
|
--checksum-fill
|