I have a kvm guest using nat (usermode networking). Because virsh in ubuntu 18.04 does not support netcf I cannot use nwfilter to control the traffic of the vm. How can I restrict the access of the vm to a set of IP adresses?



So for now I am using the /etc/libvirt/hooks/network hook: In this hook I dump the iptable-rules created by libvirt and look for the default forwarding rule for the bridge the vm is connected to. If the rule is there, it is replaced by a set of my restricted rules. If not, I assume the restricted rules are already in place.

This workaround works for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.