You are not logged in.
Pages: 1
Hi,
I switched my firewall from iptables to firewalld so that I could create QEMU/KVM virtual machines in the Red Hat virtual machine manager. I disabled and masked the iptables.service and ip6tables.service and started and enabled the firewalld.service. I noticed whenever the command firewall-cmd --reload is run; I receive the following:
firewall-cmd --reload
Error: COMMAND_FAILED: '/usr/bin/ip6tables-restore -w -n' failed: ip6tables-restore v1.8.0 (legacy): ip6tables-restore: unable to initialize table 'security'
Error occurred at line: 1
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.Why is the firewall-cmd --reload command trying to do something with ip6tables, and how do I correct this?
Offline
Because firewalld is built on top of iptables - see https://wiki.archlinux.org/index.php/Iptables. Since iptables is installed when you install Arch's base package, it would be rather difficult "switch" from iptables, but you can interact with it using different front-ends such as firewalld. So the question is really: why do you feel that your QEMU problems are because of iptables?
Offline
With iptables and QEMU, I was experiencing this issue:
https://superuser.com/questions/1063240 … ll-backend
Also, when you start and enable the firewalld service, it automatically disables the iptables service, and vice versa. Since using firewalld, I've been able to provision vm's although I'm having this issue when it comes to using the firewall-cmd --reload command.
Offline
As of v0.6.0 firewalld uses nftables as the default backend. It no longer uses iptables by default, although it still can if desired. You can check which backend is in use by running:
grep -i firewallbackend /etc/firewalld/firewalld.confThe Superuser issue -- which is now over 2 years old -- looks like it was caused by missing dependencies (ebtables, and perhaps dnsmasq) and not a result of using iptables.
Note that libvirtd depends on, and by default modifies iptables. As far as I'm aware it does not yet support the same functionality with nftables so if you are going to use firewalld on a machine running libvirtd you'll likely want to still use iptables as your backend to avoid having 2 firewalls running. While I believe this is supported, it seems overly complicated.
For what it's worth, I'm running libvirtd with iptables in a pretty vanilla setup with largely default configurations without issue. I expect this is really common and IMO, firewalld just adds an unnecessary additional layer.
Offline
@chr0mag maybe you can help with the underlying issue then because that's what this thread is actually about? You say "While I believe this is supported, it seems overly complicated." but libvirt isn't working with iptables for me either, so I'm not sure what's broken. I haven't been able to find any good info on getting libvirt to work with the current state of arch. I use libvirt for minikube and get "Failed to initialize a valid firewall backend".
I'm running:
iptables: 1:1.8.2-1
libvirt: 5.0.0-1
kernel: 4.20.8-arch1-1-ARCHI just tried reinstalling libvirt and it didn't fix anything.
libvirtd logs say:
libvirtd[867]: ethtool ioctl error: No such device
libvirtd[867]: ethtool ioctl error: No such device
libvirtd[867]: ethtool ioctl error: No such device
libvirtd[867]: ethtool ioctl error: No such device
libvirtd[867]: ethtool ioctl error: No such device
libvirtd[867]: End of file while reading data: Input/output error
libvirtd[867]: internal error: Failed to initialize a valid firewall backend
libvirtd[867]: Failed to open file '/sys/class/net/virbr0-nic/operstate': No such file or directory
libvirtd[867]: unable to read: /sys/class/net/virbr0-nic/operstate: No such file or directory
libvirtd[867]: End of file while reading data: Input/output errorOffline
@chr0mag maybe you can help with the underlying issue then because that's what this thread is actually about?
I wouldn't assume that your issue is the same as the OP's. Please post the complete output of the following commands.
ip address
journalctl --boot=0
systemctl list-units --type=serviceYou say "While I believe this is supported, it seems overly complicated."
This is specifically in reference to running iptables and nftables together which I inferred from this.
Offline
➜ ~ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 30:85:a9:42:b8:83 brd ff:ff:ff:ff:ff:ff
inet 192.168.88.242/24 brd 192.168.88.255 scope global dynamic noprefixroute enp4s0
valid_lft 373sec preferred_lft 373sec
inet6 fe80::609f:ff4e:b50c:9c5/64 scope link noprefixroute
valid_lft forever preferred_lft forever
7: lxdbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 10.180.250.1/24 scope global lxdbr0
valid_lft forever preferred_lft forever
inet6 fe80::f8cc:dbff:fe63:d9aa/64 scope link
valid_lft forever preferred_lft forever
8: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:ee:7e:04:b6 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft foreverjournalctl --boot=0➜ ~ systemctl list-units --type=service
UNIT LOAD ACTIVE SUB DESCRIPTION
alsa-restore.service loaded active exited Save/Restore Sound Card State
dbus.service loaded active running D-Bus System Message Bus
docker.service loaded active running Docker Application Container Engine
kmod-static-nodes.service loaded active exited Create list of required static device nodes for the current kernel
libvirtd.service loaded active running Virtualization daemon
lvm2-lvmetad.service loaded active running LVM2 metadata daemon
lvm2-monitor.service loaded active exited Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling
● lvm2-pvscan@8:18.service loaded failed failed LVM2 PV scan on device 8:18
● lvm2-pvscan@8:19.service loaded failed failed LVM2 PV scan on device 8:19
● lvm2-pvscan@8:2.service loaded failed failed LVM2 PV scan on device 8:2
● lvm2-pvscan@8:34.service loaded failed failed LVM2 PV scan on device 8:34
● lvm2-pvscan@8:5.service loaded failed failed LVM2 PV scan on device 8:5
lxd.service loaded active running REST API, command line tool and OpenStack integration plugin for LXC.
NetworkManager.service loaded active running Network Manager
polkit.service loaded active running Authorization Manager
rtkit-daemon.service loaded active running RealtimeKit Scheduling Policy Service
sabnzbd.service loaded active running SABnzbd binary newsreader
sddm.service loaded active running Simple Desktop Display Manager
● shadow.service loaded failed failed Verify integrity of password and group files
systemd-binfmt.service loaded active exited Set Up Additional Binary Formats
systemd-fsck-root.service loaded active exited File System Check on Root Device
systemd-fsck@dev-disk-by\x2duuid-2276\x2d3240.service loaded active exited File System Check on /dev/disk/by-uuid/2276-3240
systemd-fsck@dev-mapper-lvm_vg\x2darch_home.service loaded active exited File System Check on /dev/mapper/lvm_vg-arch_home
systemd-fsck@dev-mapper-lvm_vg\x2darch_var.service loaded active exited File System Check on /dev/mapper/lvm_vg-arch_var
systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage
systemd-journald.service loaded active running Journal Service
systemd-logind.service loaded active running Login Service
systemd-machined.service loaded active running Virtual Machine and Container Registration Service
systemd-random-seed.service loaded active exited Load/Save Random Seed
systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems
systemd-resolved.service loaded active running Network Name Resolution
systemd-sysctl.service loaded active exited Apply Kernel Variables
systemd-timesyncd.service loaded active running Network Time Synchronization
systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev
systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories
systemd-udev-trigger.service loaded active exited udev Coldplug all Devices
systemd-udevd.service loaded active running udev Kernel Device Manager
systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown
systemd-user-sessions.service loaded active exited Permit User Sessions
upower.service loaded active running Daemon for power management
user-runtime-dir@1000.service loaded active exited User Runtime Directory /run/user/1000
user@1000.service loaded active running User Manager for UID 1000
vnstat.service loaded active running vnStat network traffic monitor Offline
libvirtd[710]: direct firewall backend requested, but /sbin/ebtables is not available: No such file or directory
ebtables is needed for libvirt's default networking to function. Install that and see how far you get.
Offline
that seems to be working thanks. I'm pretty sure I read that ebtables was made part of iptables not too long ago and I remember having conflicts recently when upgrading with ebtables and other things, so not sure what happened to that. Also previously I didn't have to install an optional dependency for NAT so I just figured shits broken with all the recent ebtables nonsense.
Offline
that seems to be working thanks.
Excellent.
I'm pretty sure I read that ebtables was made part of iptables not too long ago and I remember having conflicts recently when upgrading with ebtables and other things, so not sure what happened to that.
Yes it was, briefly, but that was quickly reverted which required explicitly reinstalling ebtables: https://bugs.archlinux.org/task/60062.
Offline
iptables-nft can replace arptables, ebtables, iptables. Internally now the backend for all the interfaces is nftables but the usespace interfaces supply backwards compatibility.
Offline
Pages: 1