(Last Updated On: March 28, 2018)

Recently I had an issue with my KVM server Linux bridge as a result of Netfilter blocking all traffic to the VMs and traffic out of the VMs. I could only reach the VMs from the hypervisor. On further troubleshooting, I noticed the issue was on Netfilter filtering traffic. The solution around this was to prevent bridged traffic from getting pushed through the host’s iptables rules.

What’s netfilter and iptables?

Netfilter is a framework provided by Linux that allows various networking-related operations to be implemented in the form of customized handlers. Iptables is a widely used firewall tool that interfaces with the kernel’s netfilter packet filtering framework.

The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel’s networking stack. These kernel hooks are known as the netfilter framework.

How to disable netfilter on a KVM bridge

In order to prevent bridged traffic from getting pushed through the host’s iptables rules, you need to set kernel settings in the /proc/sys/ directory. This can be a run-time change or persistent.

For a quick overview of all settings configurable in the /proc/sys/ directory, type the command:

# sysctl -a

The sysctl command can be used in place of echo to assign values to writable files in the /proc/sys/ directory. So let’s disable netfilter on KVM bridge, for runtime change, run:

# echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables
# echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
# echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables

Note that these special settings within /proc/sys/ are lost when the machine is rebooted. To preserve custom settings, add them to the /etc/sysctl.conf file.

# cat >> /etc/sysctl.conf <<EOF
 net.bridge.bridge-nf-call-ip6tables = 0
 net.bridge.bridge-nf-call-iptables = 0
 net.bridge.bridge-nf-call-arptables = 0
 EOF
# sysctl -p /etc/sysctl.conf

Each time the system boots, the init program runs the /etc/rc.d/rc.sysinit script which contains a command to execute sysctl using /etc/sysctl.conf to determine the values passed to the kernel.

With this set, you’re good to go. Test your bridge connectivity if it’s working fine now.