Learn how to – How To disable netfilter on Linux KVM bridge

Learn how to – How To disable netfilter on Linux KVM bridge.

Recently I had an issue with my KVM server Linux bridge as a result of Netfilter blocking all traffic to the VMs and traffic out of the VMs. I could only reach the VMs from the hypervisor. On further troubleshooting, I noticed the issue was on Netfilter filtering traffic. The solution around this was to prevent bridged traffic from getting pushed through the host’s iptables rules.

What’s netfilter and iptables?

Netfilter is a framework provided by Linux that allows various networking-related operations to be implemented in the form of customized handlers. Iptables is a widely used firewall tool that interfaces with the kernel’s netfilter packet filtering framework.

The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel’s networking stack. These kernel hooks are known as the netfilter framework.

Disable netfilter on a KVM bridge

In order to prevent bridged traffic from getting pushed through the host’s iptables rules, you need to set kernel settings in the /proc/sys/ directory. This can be a run-time change or persistent.

For a quick overview of all settings configurable in the /proc/sys/ directory, type the command:

sudo sysctl -a

The sysctl command can be used in place of echo to assign values to writable files in the /proc/sys/ directory. So let’s disable netfilter on KVM bridge, for runtime change, run:

echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-arptables
echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-iptables
echo 0 | sudo tee /proc/sys/net/bridge/bridge-nf-call-ip6tables

Note that these special settings within /proc/sys/ are lost when the machine is rebooted. To preserve custom settings, add them to the /etc/sysctl.conf file.

sudo tee -a /etc/sysctl.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
EOF

Reload:

sudo sysctl -p /etc/sysctl.conf

Each time the system boots, the init program runs the /etc/rc.d/rc.sysinit script which contains a command to execute sysctl using /etc/sysctl.conf to determine the values passed to the kernel.

With this set, you’re good to go. Test your bridge connectivity if it’s working fine now.

Check more guides on KVM:

How To Create CentOS 8 KVM Image Template on OpenStack

How to extend/increase KVM Virtual Machine (VM) disk size

How to Create CentOS / Fedora / RHEL VM Templates on KVM

How to Provision VMs on KVM with Terraform