1:27 p.m.
+ Laine, from the libvirt project
On Tue, Oct 26, 2021 at 05:37:41AM -0000, David Geise wrote:
Hi,
Can someone provide the recipes for firewalling libvirt guests? I see
talk about it but no clear answers how to correctly implement it.
I can try.
Firewalld v0.9.0+ has policy objects which allow forward filtering. I
think that will help in many areas you point to below.
This blog may also be useful:
https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-t...
I would like to be able to enable the following typical scenarios:
1. Guest restricted to connecting to existing vpn
(privateinternetaccess.com) established by PIA app on a given
branch. No in or out connections to LAN resources. No connections
to other guests.
Newer libvirt uses a "libvirt" zone. You should put your VPN interface
into a separate zone, e.g. "vpn". Then you can create one policy to
allow forwarding to the VPN and second policy to deny everything else.
A policy to allow forward from libvirt --> VPN would look like this
(untested):
# firewall-cmd --permanent --new-policy libvirtToVpn
# firewall-cmd --permanent --policy libvirtToVpn --priority -100
# firewall-cmd --permanent --policy libvirtToVpn \
--add-ingress-zone libvirt
# firewall-cmd --permanent --policy libvirtToVpn \
--add-egress-zone vpn
# firewall-cmd --permanent --policy libvirtToVpn \
--set-target ACCEPT
A policy to deny forward from libvirt --> world would look like this
(untested):
# firewall-cmd --permanent --new-policy libvirtToWorld
# firewall-cmd --permanent --policy libvirtToWorld --priority -99
# firewall-cmd --permanent --policy libvirtToWorld \
--add-ingress-zone libvirt
# firewall-cmd --permanent --policy libvirtToWorld \
--add-egress-zone ANY
# firewall-cmd --permanent --policy libvirtToWorld \
--set-target REJECT
Note: libvirtToWorld uses a lower precedence priority value so it will
execute _after_ libvirtToVpn.
Note 2: Since firewalld is stateful the return traffic will implicitly
be allowed.
2. Direct connection to WAN via gateway. Bypasses VPN. No
connections to LAN. No connections to other guests.
Similar to above, but put your gateway into a separate zone, e.g.
"external".
3. Guest connection to resources provided by VM host only.
I don't understand what you mean by this.
I know this is a big ask, but I've been reading posts here &
elsewhere and its a bit confusing.
No problem. This is why the mailing list exists. :)
Previously I had this kluged together through a series of iptables
scripts but it was an awful hack and I'd like to do better this time.
This is on kubuntu 20.10 (firewalld 0.9.3, libvirt 7.6.0, QEMU 6.0.0), pretty close to
stock setup.
Hopefully the above points you in the correct direction.
Eric.