enabling firewalling of bridged interfaces

enabling firewalling of bridged interfaces

[Jared]

Hi.

What do I need to do to enable iptables support for bridged interfaces?  I'm
setting up a Gentoo/KVM VM host, and iptables will handle all traffic
to/from the host system, but not any of the guests.  I seem to be missing
some key kernel config option for this (specifically, whatever provides
net.bridge.bridge-nf-call-iptables), but can't figure out what (more details
below).  Is there a specific list of options I should enable, or perhaps a
reference guide for this somewhere?

Long version:

This is going to replace an aging Debian-based Xen VM host, where iptables
firewalling of the guests from the host works perfectly fine.  On the
current system, iptables seems to completely ignore (and, thus, permit) all
traffic to/from the bridged interfaces.

According to the libvirt wiki
(http://wiki.libvirt.org/page/Networking#Bridged_networking_.28aka_.22shared_physical_device.22.29),
the following sysctl parameters should be enabled to see bridged traffic:

net.bridge.bridge-nf-call-ip6tables
net.bridge.bridge-nf-call-iptables
net.bridge.bridge-nf-call-arptables

But, those values don't exist on my Gentoo host.  Similarly, the
/proc/sys/net/bridge directory doesn't exist on on my Gentoo host, whereas
it does exist on Debian and all files within that directory are set to 1.

Since I compiled my own kernel, I'm assuming I must be missing something
required for this.  Problem is, I can't figure out what.  Based on what I've
read, support for "802.1d Ethernet Bridging" and "Bridged IP/ARP packets
filtering" should be all I need, which I do have enabled:

CONFIG_BRIDGE=y
CONFIG_BRIDGE_NETFILTER=y
# CONFIG_BRIDGE_NF_EBTABLES is not set
# CONFIG_BRIDGE_IGMP_SNOOPING is not set
# CONFIG_EDAC_SBRIDGE is not set

Any ideas what else I'm missing?  Here's my full kernel config, if it'd help:
http://www.legroom.net/public/config-kvm

I've been beating my head against this for a while now.  Would appreciate
any guidance.

Thanks!

-- 
Jared

Re: enabling firewalling of bridged interfaces

[Jared]

On 07/22/2012 04:23 PM, Jared wrote:
> What do I need to do to enable iptables support for bridged interfaces?  I'm
> setting up a Gentoo/KVM VM host, and iptables will handle all traffic
> to/from the host system, but not any of the guests.  I seem to be missing
> some key kernel config option for this (specifically, whatever provides
> net.bridge.bridge-nf-call-iptables), but can't figure out what (more details
> below).  Is there a specific list of options I should enable, or perhaps a
> reference guide for this somewhere?

Well, nevermind.  Rebooting fixed the problem.  I was certain I had already
configured all of the necessary bridging settings before my last reboot, so
I didn't bother trying that before sending this e-mail.  After wasting
another hour and still having no luck, though, I figured what the hell...
and sure enough it worked.

So, I'm good now.  Sorry for the noise.  :-)

-- 
Jared