On Sun, Nov 17, 2019 at 10:14 AM Ed Greshko <ed.greshko(a)greshko.com> wrote:
On 11/17/19 5:07 PM, Tom H wrote:
> On Sun, Nov 17, 2019 at 1:49 AM Ed Greshko <ed.greshko(a)greshko.com> wrote:
>>
>> I put the interface virbr0 in the FW zone libvirt.
>
> Wow. Weird that virbr0 is firewalled, but good to know. Thanks.
Yep, and as my other post states I think it always was there. If
one reads the description in
/usr/lib/firewalld/zones/libvirt.xml they'd see.
<description>
The default policy of "ACCEPT" allows all packets to/from
interfaces in the zone to be forwarded, while the (*low priority*)
reject rule blocks any traffic destined for the host, except those
services explicitly listed (that list can be modified as required
by the local admin). This zone is intended to be used only by
libvirt virtual networks - libvirt will add the bridge devices for
all new virtual networks to this zone by default.
</description>
Thanks. I assume that you didn't just add virbr0 to the libvirt zone,
but that you also added the three nfs-related services to this zone.
Comment from the libvirt source
/* if firewalld is active, try to set the "libvirt" zone. This is
* desirable (for consistency) if firewalld is using the iptables
* backend, but is necessary (for basic network connectivity) if
* firewalld is using the nftables backend
*/
So it's an nftables requirement.