Bug 615144 - iptable rules generated by libvirt will deny nfs access from guest with NAT network.
iptable rules generated by libvirt will deny nfs access from guest with NAT n...
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt (Show other bugs)
6.0
All Linux
low Severity high
: rc
: ---
Assigned To: Daniel Veillard
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-07-15 22:26 EDT by Johnny Liu
Modified: 2010-07-19 06:03 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-07-19 06:03:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Johnny Liu 2010-07-15 22:26:17 EDT
Description of problem:
After install libvirt-0.8.1-15.el6.x86_64, the following iptable rules is generated in nat table by libvirt.

Table: nat
...
Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
2    MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
3    MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24
...

In guest, try to mount a remote nfs share directory, the access is denied.
After deleted the 1th and 2th rules in POSTROUTING chain, mount nfs directroy successfully.

Version-Release number of selected component (if applicable):
libvirt-0.8.1-15.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Check the iptable.
# service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
2    MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
3    MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24    

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
   

2. In guest (my guest is rhel6_x86_64), try to mount a nfs share directroy.
Note: My guest is using NAT virtual network.
# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr BC:D0:51:1C:D9:74  
          inet addr:192.168.122.17  Bcast:192.168.122.255  Mask:255.255.255.0
          inet6 addr: fe80::bed0:51ff:fe1c:d974/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:155 errors:0 dropped:0 overruns:0 frame:0
          TX packets:183 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:12554 (12.2 KiB)  TX bytes:17802 (17.3 KiB)
          Interrupt:11 Base address:0xc000

# mount 10.66.90.113:/vol/xenimage /mnt
mount.nfs: access denied by server while mounting 10.66.90.113:/vol/xenimage

# ping 10.66.90.113
PING 10.66.90.113 (10.66.90.113) 56(84) bytes of data.
64 bytes from 10.66.90.113: icmp_seq=1 ttl=253 time=0.360 ms
64 bytes from 10.66.90.113: icmp_seq=2 ttl=253 time=0.340 ms
....

3. On host, delete the 1th and 2th rules in POSTROUTING chain of nat table.
# iptables -t nat -D POSTROUTING 1
# iptables -t nat -D POSTROUTING 1
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24    

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  
Actual results:

4. In guest, mount nfs directroy successfully.
# mount 10.66.90.113:/vol/xenimage /mnt


Expected results:
In step 2, nfs access from guest with NAT network should not be denied by iptable rules generated by libvirt.

Additional info:
Comment 2 RHEL Product and Program Management 2010-07-15 22:58:44 EDT
This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release. It has
been denied for the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **
Comment 3 Daniel Berrange 2010-07-16 05:39:12 EDT
This restriction is *intentional* because allowing guests access to the NFS server was a security flaw:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2242


If you want the guests to have access to your NFS server, you should be able to enable it on your NFS server by editing /etc/exports and adding the 'insecure' flag (see 'man exports' for more details).
Comment 4 Johnny Liu 2010-07-19 04:11:14 EDT
Daniel, 
u are right. 
After I add the 'insecure' flag in /etc/exports for my nfs server, the guest access the nfs server successfully.

Note You need to log in before you can comment on or make changes to this bug.