Recently I had an issue with my KVM server Linux bridge as a result of Netfilter blocking all traffic to the VMs and traffic out of the VMs. I could only reach the VMs from the hypervisor. On further troubleshooting, I noticed the issue was on Netfilter filtering traffic. The solution around this was to prevent bridged traffic from getting pushed through the host’s iptables rules.
What’s netfilter and iptables?
Netfilter is a framework provided by Linux that allows various networking-related operations to be implemented in the form of customized handlers. Iptables is a widely used firewall tool that interfaces with the kernel’s netfilter packet filtering framework.
The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel’s networking stack. These kernel hooks are known as the netfilter framework.
Disable netfilter on a KVM bridge
In order to prevent bridged traffic from getting pushed through the host’s iptables rules, you need to set kernel settings in the /proc/sys/ directory. This can be a run-time change or persistent.
For a quick overview of all settings configurable in the /proc/sys/ directory, type the command:
sudo sysctl -a
The sysctl command can be used in place of echo to assign values to writable files in the /proc/sys/ directory. So let’s disable netfilter on KVM bridge, for runtime change, run:
echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-arptables echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-iptables echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-ip6tables
Note that these special settings within /proc/sys/ are lost when the machine is rebooted. To preserve custom settings, add them to the /etc/sysctl.conf file.
sudo tee -a /etc/sysctl.conf <
sudo sysctl -p /etc/sysctl.conf
Each time the system boots, the init program runs the /etc/rc.d/rc.sysinit script which contains a command to execute sysctl using /etc/sysctl.conf to determine the values passed to the kernel.
With this set, you’re good to go. Test your bridge connectivity if it’s working fine now.