![](https://seccdn.libravatar.org/avatar/a895f78a81a109471893519443e4d933.jpg?s=120&d=mm&r=g)
https://bugzilla.suse.com/show_bug.cgi?id=1226105 https://bugzilla.suse.com/show_bug.cgi?id=1226105#c9 James Fehlig <jfehlig@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(alexander.graul@s | |use.com) --- Comment #9 from James Fehlig <jfehlig@suse.com> --- (In reply to Alexander Graul from comment #7)
i | iptables-backend-nft | Metapackage to make nft the default backend for iptables/arptables/ebtables | package
iptables-backend-nft creates two top level nftable tables that are shared by all applications using iptables. You can see them in your 'nft list ruleset ip' output, with a warning not to touch :-). With libvirt's switch to using nftables directly, it now creates its own top level table. And recall in nftables, for a packet to get through it must be allowed by all top level tables. Notice in your output the 'ip filter' table has type filter hook forward priority filter; policy drop; This github issue comment has more details https://gitlab.com/libvirt/libvirt/-/issues/644#note_1940628451 The issue also describes why it works prior to the switch to using nftables directly, and a workaround. E.g. in /etc/libvirt/network.conf, set firewall_backend = "iptables" and restart virtnetworkd (or libvirtd if you're using monolithic daemon). Does this work for you? FYI, this post has a nice description of relationship between iptables, iptables-nft, and nftables https://developers.redhat.com/blog/2020/08/18/iptables-the-two-variants-and-... -- You are receiving this mail because: You are on the CC list for the bug.