[Qemu-devel] Firewalling emulated hosts?

[Thomas Munn]

Dear Sirs:

I have used the following setup:

qemu-host=192.168.1.1   NAT 178.155.1.1 (on eth0:1)
tun0=192.168.1.254      (gateway)

Iptables re-nats in and out for the qemu-host.  Everything works fine,
packets go in and out etc.

However, when I try to use iptables to stop just port 80 (as a test)
with: (on the host, not guest os!)

iptables -A OUTPUT -o tun0 -p tcp -s 192.168.1.1 --destination-port 80
-j DROP

Port 80 still works.  

I tried changing to input, and this didn't work either.  I tried
changing to the natted address, this didn't work.  I tried changing to
eth0:1 (iptables barfed).

So my question is this:  How do I write iptables rules for guest oses on
my computer using the tap0 interface & iptables natting?  I even tried
doing this inside the qemu-ifup script.  For your viewing pleasure here
is my qemu-ifup script:

qemu_ip="178.155.1.1"
qemu_netmask="255.255.255.0"

# Setup an interface for the vm to use
ifconfig eth0:1 up $qemu_ip netmask $qemu_netmask

# Clear iptables
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING

# Setup NAT
iptables -t nat -A PREROUTING -d $qemu_ip \
        -j DNAT --to-destination 192.168.1.1
        iptables -t nat -A POSTROUTING -s 192.168.1.1 \
                -j SNAT --to-source $qemu_ip

## My iptables line is here
iptables -A OUTPUT -p tcp -s 192.168.1.1 --destination-port 80 -j DROP
                # Bring up the TUN interface
                exec /sbin/ifconfig $1 192.168.1.254

Thomas








---------------------------
Thomas  Munn CISSP
Security Analyst
Shands Hospital
address@hidden