615144 – iptable rules generated by libvirt will deny nfs access from guest with NAT network.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 615144 - iptable rules generated by libvirt will deny nfs access from guest with NAT network.

Summary: iptable rules generated by libvirt will deny nfs access from guest with NAT n...

Keywords:
Status:	CLOSED NOTABUG
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	libvirt
Sub Component:
Version:	6.0
Hardware:	All
OS:	Linux
Priority:	low
Severity:	high
Target Milestone:	rc
Target Release:	---
Assignee:	Daniel Veillard
QA Contact:	Virtualization Bugs
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2010-07-16 02:26 UTC by Johnny Liu
Modified:	2010-07-19 10:03 UTC (History)
CC List:	6 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2010-07-19 10:03:50 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Johnny Liu 2010-07-16 02:26:17 UTC

Description of problem:
After install libvirt-0.8.1-15.el6.x86_64, the following iptable rules is generated in nat table by libvirt.

Table: nat
...
Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
2    MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
3    MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24
...

In guest, try to mount a remote nfs share directory, the access is denied.
After deleted the 1th and 2th rules in POSTROUTING chain, mount nfs directroy successfully.

Version-Release number of selected component (if applicable):
libvirt-0.8.1-15.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Check the iptable.
# service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
2    MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535 
3    MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24    

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
   

2. In guest (my guest is rhel6_x86_64), try to mount a nfs share directroy.
Note: My guest is using NAT virtual network.
# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr BC:D0:51:1C:D9:74  
          inet addr:192.168.122.17  Bcast:192.168.122.255  Mask:255.255.255.0
          inet6 addr: fe80::bed0:51ff:fe1c:d974/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:155 errors:0 dropped:0 overruns:0 frame:0
          TX packets:183 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:12554 (12.2 KiB)  TX bytes:17802 (17.3 KiB)
          Interrupt:11 Base address:0xc000

# mount 10.66.90.113:/vol/xenimage /mnt
mount.nfs: access denied by server while mounting 10.66.90.113:/vol/xenimage

# ping 10.66.90.113
PING 10.66.90.113 (10.66.90.113) 56(84) bytes of data.
64 bytes from 10.66.90.113: icmp_seq=1 ttl=253 time=0.360 ms
64 bytes from 10.66.90.113: icmp_seq=2 ttl=253 time=0.340 ms
....

3. On host, delete the 1th and 2th rules in POSTROUTING chain of nat table.
# iptables -t nat -D POSTROUTING 1
# iptables -t nat -D POSTROUTING 1
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24    

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  
Actual results:

4. In guest, mount nfs directroy successfully.
# mount 10.66.90.113:/vol/xenimage /mnt


Expected results:
In step 2, nfs access from guest with NAT network should not be denied by iptable rules generated by libvirt.

Additional info:

Comment 2 RHEL Program Management 2010-07-16 02:58:44 UTC

This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release. It has
been denied for the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **

Comment 3 Daniel Berrangé 2010-07-16 09:39:12 UTC

This restriction is *intentional* because allowing guests access to the NFS server was a security flaw:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2242


If you want the guests to have access to your NFS server, you should be able to enable it on your NFS server by editing /etc/exports and adding the 'insecure' flag (see 'man exports' for more details).

Comment 4 Johnny Liu 2010-07-19 08:11:14 UTC

Daniel, 
u are right. 
After I add the 'insecure' flag in /etc/exports for my nfs server, the guest access the nfs server successfully.

Note You need to log in before you can comment on or make changes to this bug.