libvirt users - May 2017 - Re: nwfilter and address of network ip address

On Fri, May 5, 2017 at 4:29 PM, Nicolas Bock <nicolasbock@gmail.com>
wrote:
> Hi,
>
> I am running a webserver on the libvirt host and would like to add a
> nwfilter such that a VM can access that server. The corresponding iptables
> rule would look like this:
>
> iptables --append INPUT --in-interface virbr0 --destination 192.168.122.1
> --protocol tcp --dport 80 --jump ACCEPT
>
> where the network is using virbr0 and sits at 192.168.122.1. I don't
want
> to hardcode the host IP address in the nwfilter so that I can use that
> filter for other networks. Is it possible to reference the host's IP
> address in the filter?
>
> Thanks!
>
> Nick
>
> Hi Nick,
I used to have similar question before too. Not sure if this could be
helpful for you,
Probably just use arp or arpscan. But to be more specific, if the domain
name of the
client (assuming you want to confine HTTP service to only a selected few
clients, e.g.,
192.168.122.1 in your case) is known, you probably could do

$ virsh domiflist DOMAIN

In particular, to get the IP address of a domain, it is something like the
following:

$ for MAC in `virsh domiflist <DOMAIN> | grep -o -E
"([0-9a-f]{2}:){5}([0-9a-f]{2})"` ; do
        arp -e | grep $MAC  | grep -o -P
"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" ;
   done

Alternatively, if the NETWORK name is known, IP addr can be obtained
directly with

$ virsh net-dhcp-leases NETWORK

Another way to the get IP addr, if qemu guest agent is installed on the
client,

$ virsh domifaddr DOMAIN

So that you can pass IP to the XML, and somehow you can trigger the update
of
NWFILTER with some magic, quite a hack.

Or, you could just use client's MAC addr to define the filter:
https://libvirt.org/formatnwfilter.html#nwfelemsRulesProtoMAC

But I don't think there is direct way to specify a client's domain name
in
the NWFILTER XML definition as of now.

P.S. I am new to libvirt, so everything above could be wrong.

Dan

_______________________________________________
> libvirt-users mailing list
> libvirt-users@redhat.com
> https://www.redhat.com/mailman/listinfo/libvirt-users
>

Hi Dan,

On Sat, May 06, 2017 at 08:09:49PM -0400, Dan wrote:
>On Fri, May 5, 2017 at 4:29 PM, Nicolas Bock <nicolasbock@gmail.com>
wrote:
>
>> Hi,
>>
>> I am running a webserver on the libvirt host and would like to add a
>> nwfilter such that a VM can access that server. The corresponding
iptables
>> rule would look like this:
>>
>> iptables --append INPUT --in-interface virbr0 --destination
192.168.122.1
>> --protocol tcp --dport 80 --jump ACCEPT
>>
>> where the network is using virbr0 and sits at 192.168.122.1. I
don't want
>> to hardcode the host IP address in the nwfilter so that I can use that
>> filter for other networks. Is it possible to reference the host's
IP
>> address in the filter?
>>
>> Thanks!
>>
>> Nick
>>
>> Hi Nick,
>
>I used to have similar question before too. Not sure if this could be
>helpful for you, Probably just use arp or arpscan. But to be more 
>specific, if the domain name of the client (assuming you want to 
>confine HTTP service to only a selected few clients, e.g.,
>192.168.122.1 in your case) is known, you probably could do
>
>$ virsh domiflist DOMAIN
>
>In particular, to get the IP address of a domain, it is something like the
>following:
>
>$ for MAC in `virsh domiflist <DOMAIN> | grep -o -E
>"([0-9a-f]{2}:){5}([0-9a-f]{2})"` ; do
>        arp -e | grep $MAC  | grep -o -P
>"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" ;
>   done
>
>Alternatively, if the NETWORK name is known, IP addr can be obtained
>directly with
>
>$ virsh net-dhcp-leases NETWORK
>
>Another way to the get IP addr, if qemu guest agent is installed on the
>client,
>
>$ virsh domifaddr DOMAIN
>
>So that you can pass IP to the XML, and somehow you can trigger the update
>of NWFILTER with some magic, quite a hack.
Thanks! I was hoping for something less hacky :)
>Or, you could just use client's MAC addr to define the filter:
>https://libvirt.org/formatnwfilter.html#nwfelemsRulesProtoMAC
>
>But I don't think there is direct way to specify a client's domain
name in
>the NWFILTER XML definition as of now.
>
>P.S. I am new to libvirt, so everything above could be wrong.
>
>Dan

On Sat, May 06, 2017 at 08:09:49PM -0400, Dan wrote:
> On Fri, May 5, 2017 at 4:29 PM, Nicolas Bock <nicolasbock@gmail.com>
wrote:
> 
> > Hi,
> >
> > I am running a webserver on the libvirt host and would like to add a
> > nwfilter such that a VM can access that server. The corresponding
iptables
> > rule would look like this:
> >
> > iptables --append INPUT --in-interface virbr0 --destination
192.168.122.1
> > --protocol tcp --dport 80 --jump ACCEPT
> >
> > where the network is using virbr0 and sits at 192.168.122.1. I
don't want
> > to hardcode the host IP address in the nwfilter so that I can use that
> > filter for other networks. Is it possible to reference the host's
IP
> > address in the filter?
There is a pre-defined parameter for the VM's own IP address:

  http://libvirt.org/formatnwfilter.html#nwfelemsRulesAdvIPAddrDetection

but we don't have anything for the host's IP address. We could fairly
easily add it though I reckon - eg provide a HOST_IP parameter.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

On Mon, May 08, 2017 at 03:35:19PM +0100, Daniel P. Berrange
wrote:
>On Sat, May 06, 2017 at 08:09:49PM -0400, Dan wrote:
>> On Fri, May 5, 2017 at 4:29 PM, Nicolas Bock
<nicolasbock@gmail.com> wrote:
>>
>> > Hi,
>> >
>> > I am running a webserver on the libvirt host and would like to add
a
>> > nwfilter such that a VM can access that server. The corresponding
iptables
>> > rule would look like this:
>> >
>> > iptables --append INPUT --in-interface virbr0 --destination
192.168.122.1
>> > --protocol tcp --dport 80 --jump ACCEPT
>> >
>> > where the network is using virbr0 and sits at 192.168.122.1. I
don't want
>> > to hardcode the host IP address in the nwfilter so that I can use
that
>> > filter for other networks. Is it possible to reference the
host's IP
>> > address in the filter?
>
>There is a pre-defined parameter for the VM's own IP address:
>
>  http://libvirt.org/formatnwfilter.html#nwfelemsRulesAdvIPAddrDetection
>
>but we don't have anything for the host's IP address. We could
fairly
>easily add it though I reckon - eg provide a HOST_IP parameter.
Thanks Daniel.
>Regards,
>Daniel