Ubuntu – Can ufw on a kvm host restrict traffic to guests

bridgefirewallkvm-virtualizationUbuntuufw

I've set up a number of guests running on kvm on Ubuntu. Network access for the guests is via network bridge with br0 sitting on top of eth0. I have ufw running on the host machine and this is restricting traffic to the host. Is there a way to make the rules on the host apply to all the guests, so blocking a port on the host firewall would prevent access on all the guests?

Best Answer

I'm not sure about ufw specifically, but I can block / filter ports to guests by using iptables on the host. You must add the rules to the FORWARD chain. If you can access the FORWARD chain from ufw, then add your rules to it, and they should apply to the guests as well.

Related Solutions

How to get the IP addresses of KVM guests that are using a Bridge Network Device from the KVM host

The only proper way of achieving this is to have a service in the guest that would report guest data (IP, software installed, etc) to the host using the hyperchannel. This is already available in RHEV for windows guests, and will be available for linux guests soon enough as well. If you want to get your own stuff done, you can write such an agent yourself - this is open source after all

Ubuntu – Firewall on a KVM host, prevent access to VM:s

iptables can be set up to check bridge traffic. I usually disable it to improve performance, but you can do the opposite: /etc/sysctl.conf:

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

If you set either of these to 1 instead of 0 you'll have the host iptables filtering the traffic for the bridge.

Another solution would be to stop using the bridge, and use libvirts' NAT implementation, which uses iptables as well

EDIT: since both ways are rather faulty IMO, I would run the firewalls in the guests themselves, leaving them on a normal bridged network. or, which would be even more proper, run a separate firewall appliance in front of the virtual infrastructure

Best Answer

Related Solutions

How to get the IP addresses of KVM guests that are using a Bridge Network Device from the KVM host

Ubuntu – Firewall on a KVM host, prevent access to VM:s

Related Topic