Bug 615144
| Summary: | iptable rules generated by libvirt will deny nfs access from guest with NAT network. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Johnny Liu <jialiu> |
| Component: | libvirt | Assignee: | Daniel Veillard <veillard> |
| Status: | CLOSED NOTABUG | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | low | ||
| Version: | 6.0 | CC: | berrange, eblake, llim, tyan, xen-maint, yoyzhang |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-07-19 10:03:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This issue has been proposed when we are only considering blocker issues in the current Red Hat Enterprise Linux release. It has been denied for the current Red Hat Enterprise Linux release. ** If you would still like this issue considered for the current release, ask your support representative to file as a blocker on your behalf. Otherwise ask that it be considered for the next Red Hat Enterprise Linux release. ** This restriction is *intentional* because allowing guests access to the NFS server was a security flaw: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2242 If you want the guests to have access to your NFS server, you should be able to enable it on your NFS server by editing /etc/exports and adding the 'insecure' flag (see 'man exports' for more details). Daniel, u are right. After I add the 'insecure' flag in /etc/exports for my nfs server, the guest access the nfs server successfully. |
Description of problem: After install libvirt-0.8.1-15.el6.x86_64, the following iptable rules is generated in nat table by libvirt. Table: nat ... Chain POSTROUTING (policy ACCEPT) num target prot opt source destination 1 MASQUERADE tcp -- 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 2 MASQUERADE udp -- 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 3 MASQUERADE all -- 192.168.122.0/24 !192.168.122.0/24 ... In guest, try to mount a remote nfs share directory, the access is denied. After deleted the 1th and 2th rules in POSTROUTING chain, mount nfs directroy successfully. Version-Release number of selected component (if applicable): libvirt-0.8.1-15.el6.x86_64 How reproducible: Always Steps to Reproduce: 1. Check the iptable. # service iptables status Table: nat Chain PREROUTING (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination 1 MASQUERADE tcp -- 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 2 MASQUERADE udp -- 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 3 MASQUERADE all -- 192.168.122.0/24 !192.168.122.0/24 Chain OUTPUT (policy ACCEPT) num target prot opt source destination Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination 2. In guest (my guest is rhel6_x86_64), try to mount a nfs share directroy. Note: My guest is using NAT virtual network. # ifconfig eth0 eth0 Link encap:Ethernet HWaddr BC:D0:51:1C:D9:74 inet addr:192.168.122.17 Bcast:192.168.122.255 Mask:255.255.255.0 inet6 addr: fe80::bed0:51ff:fe1c:d974/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:155 errors:0 dropped:0 overruns:0 frame:0 TX packets:183 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:12554 (12.2 KiB) TX bytes:17802 (17.3 KiB) Interrupt:11 Base address:0xc000 # mount 10.66.90.113:/vol/xenimage /mnt mount.nfs: access denied by server while mounting 10.66.90.113:/vol/xenimage # ping 10.66.90.113 PING 10.66.90.113 (10.66.90.113) 56(84) bytes of data. 64 bytes from 10.66.90.113: icmp_seq=1 ttl=253 time=0.360 ms 64 bytes from 10.66.90.113: icmp_seq=2 ttl=253 time=0.340 ms .... 3. On host, delete the 1th and 2th rules in POSTROUTING chain of nat table. # iptables -t nat -D POSTROUTING 1 # iptables -t nat -D POSTROUTING 1 # iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 192.168.122.0/24 !192.168.122.0/24 Chain OUTPUT (policy ACCEPT) target prot opt source destination Actual results: 4. In guest, mount nfs directroy successfully. # mount 10.66.90.113:/vol/xenimage /mnt Expected results: In step 2, nfs access from guest with NAT network should not be denied by iptable rules generated by libvirt. Additional info: