diff options
| author | Simon Rettberg | 2024-10-31 17:03:34 +0100 |
|---|---|---|
| committer | Simon Rettberg | 2024-10-31 17:03:34 +0100 |
| commit | c7ec31d43c3530e5463d7f4d51caedf3fab41d1e (patch) | |
| tree | 1615036764f1fa5ee4bc475f598f416ac0c4d292 | |
| parent | [qemu] Only enable looking-glass for windows 10/11 guest (diff) | |
| download | mltk-c7ec31d43c3530e5463d7f4d51caedf3fab41d1e.tar.gz mltk-c7ec31d43c3530e5463d7f4d51caedf3fab41d1e.tar.xz mltk-c7ec31d43c3530e5463d7f4d51caedf3fab41d1e.zip | |
[run-virt] dnsmasq: fix interface listen, log to file
For some reason, even without bind-interfaces, when using
iptables -j REDIRECT, dnsmasq doesn't see any redirected queries,
probably becuase it recognizes the actual source of the packet as not
belonging to the interface it's being told to listen on.
| -rw-r--r-- | core/modules/run-virt/data/opt/openslx/vmchooser/run-virt.d/setup_firewall.inc | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/core/modules/run-virt/data/opt/openslx/vmchooser/run-virt.d/setup_firewall.inc b/core/modules/run-virt/data/opt/openslx/vmchooser/run-virt.d/setup_firewall.inc index c62a0862..e07df735 100644 --- a/core/modules/run-virt/data/opt/openslx/vmchooser/run-virt.d/setup_firewall.inc +++ b/core/modules/run-virt/data/opt/openslx/vmchooser/run-virt.d/setup_firewall.inc @@ -30,6 +30,9 @@ setup_firewall () { fi # Run dnsmasq if applicable if [ -s "$DNSMASQ_CONF" ]; then + # If we want to support bridged VMs in the future, we need to listen on br0 too, but then + # we need to block incoming traffic on this port (via set-firewall script) + # using physdev matching. cat >> "$DNSMASQ_CONF" <<-DNSCONF keep-in-foreground pid-file=/tmp/dns-$RANDOM.$RANDOM.$RANDOM @@ -38,15 +41,17 @@ setup_firewall () { no-resolv port=$port interface=lo - bind-interfaces - log-facility=- + interface=nat1 + interface=vsw2 + log-facility=${DNSMASQ_CONF}.log DNSCONF if ! dnsmasq --test --conf-file="$DNSMASQ_CONF" &> "${DNSMASQ_CONF}.tmp"; then cat "${DNSMASQ_CONF}.tmp" >> "${DNSMASQ_CONF}" rm -f -- "${DNSMASQ_CONF}.tmp" - slxlog -s -d "virt-firewall" "Invalid dnsmasq.conf was generated" "$DNSMASQ_CONF" + slxlog -s "virt-firewall" "Invalid dnsmasq.conf was generated" "$DNSMASQ_CONF" return 1 fi + rm -f -- "${DNSMASQ_CONF}.tmp" # All seems well, launch for real run_dnsmasq_fw "$port" add_cleanup "cleanup_firewall" |