I have set up the virtual lab environment as per Michael Jang's RHCSA/RHCE guide on a CentOS 6.3 system.

'default' virtual network 192.168.122.0/24
'outsider' virtual network 192.168.100.0/24

I can ping from 'default' network to 'outsider' network but not the other way round.

The issue is that libvirtd automatically adds rules to the FORWARD chain within iptables on the physical host, but these rules actually prevent proper connectivity between the virtual networks.

Here is the FORWARD chain after a service libvirtd restart.

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.0/24 state RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
ACCEPT all -- anywhere 192.168.100.0/24 state RELATED,ESTABLISHED
ACCEPT all -- 192.168.100.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited


Deleting all the REJECT rules apart from the last one restored the desired connectivity. See below.


Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.0/24 state RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere 192.168.100.0/24 state RELATED,ESTABLISHED
ACCEPT all -- 192.168.100.0/24 anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

I saved this to /etc/sysconfig/iptables and the following line was added to /etc/rc.local

/sbin/service iptables restart

This ensures everything is okay after a reboot of the physical host, but whenever libvirtd is restarted, iptables also has to be restarted to overwrite what libvirtd just added.

Question:

How can I configure libvirtd to automatically generate FORWARD rules that allow connectivity between the two virtual networks?

philx66

Hello,

I am keeping an eye on your post as I have just posted my own problem which seems to be very similar.

http://www.linuxquestions.org/questi...em-4175430246/

I will post a reply if I figure anything out!