mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-11-06 13:20:20 +00:00
c6cbe18771
Creating firewall rules for the virtual networks causes the kernel to load the conntrack module. This imposes a significant performance penalty on Linux network traffic. Thus we want to only take that hit if we actually have virtual networks running. We need to create global firewall rules during startup in order to "upgrade" rules for any running networks created by older libvirt. If no running networks are present though, we can safely delay setup until the time we actually start a network. Reviewed-by: Jim Fehlig <jfehlig@suse.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
117 lines
1.9 KiB
Plaintext
117 lines
1.9 KiB
Plaintext
iptables \
|
|
--table filter \
|
|
--list-rules
|
|
iptables \
|
|
--table nat \
|
|
--list-rules
|
|
iptables \
|
|
--table mangle \
|
|
--list-rules
|
|
iptables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_INP
|
|
iptables \
|
|
--table filter \
|
|
--insert INPUT \
|
|
--jump LIBVIRT_INP
|
|
iptables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_OUT
|
|
iptables \
|
|
--table filter \
|
|
--insert OUTPUT \
|
|
--jump LIBVIRT_OUT
|
|
iptables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_FWO
|
|
iptables \
|
|
--table filter \
|
|
--insert FORWARD \
|
|
--jump LIBVIRT_FWO
|
|
iptables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_FWI
|
|
iptables \
|
|
--table filter \
|
|
--insert FORWARD \
|
|
--jump LIBVIRT_FWI
|
|
iptables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_FWX
|
|
iptables \
|
|
--table filter \
|
|
--insert FORWARD \
|
|
--jump LIBVIRT_FWX
|
|
iptables \
|
|
--table nat \
|
|
--new-chain LIBVIRT_PRT
|
|
iptables \
|
|
--table nat \
|
|
--insert POSTROUTING \
|
|
--jump LIBVIRT_PRT
|
|
iptables \
|
|
--table mangle \
|
|
--new-chain LIBVIRT_PRT
|
|
iptables \
|
|
--table mangle \
|
|
--insert POSTROUTING \
|
|
--jump LIBVIRT_PRT
|
|
ip6tables \
|
|
--table filter \
|
|
--list-rules
|
|
ip6tables \
|
|
--table nat \
|
|
--list-rules
|
|
ip6tables \
|
|
--table mangle \
|
|
--list-rules
|
|
ip6tables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_INP
|
|
ip6tables \
|
|
--table filter \
|
|
--insert INPUT \
|
|
--jump LIBVIRT_INP
|
|
ip6tables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_OUT
|
|
ip6tables \
|
|
--table filter \
|
|
--insert OUTPUT \
|
|
--jump LIBVIRT_OUT
|
|
ip6tables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_FWO
|
|
ip6tables \
|
|
--table filter \
|
|
--insert FORWARD \
|
|
--jump LIBVIRT_FWO
|
|
ip6tables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_FWI
|
|
ip6tables \
|
|
--table filter \
|
|
--insert FORWARD \
|
|
--jump LIBVIRT_FWI
|
|
ip6tables \
|
|
--table filter \
|
|
--new-chain LIBVIRT_FWX
|
|
ip6tables \
|
|
--table filter \
|
|
--insert FORWARD \
|
|
--jump LIBVIRT_FWX
|
|
ip6tables \
|
|
--table nat \
|
|
--new-chain LIBVIRT_PRT
|
|
ip6tables \
|
|
--table nat \
|
|
--insert POSTROUTING \
|
|
--jump LIBVIRT_PRT
|
|
ip6tables \
|
|
--table mangle \
|
|
--new-chain LIBVIRT_PRT
|
|
ip6tables \
|
|
--table mangle \
|
|
--insert POSTROUTING \
|
|
--jump LIBVIRT_PRT
|