Firewall rules for a Win10 VM on KVM+QEMU (VirtManager)

[arturasb]

Hi.

Please consult me on how to limit network access to “internet only” (no network access to F37 host or LAN resources) for Windows 10 VM on KVM+QEMU (VirtManager). Should FW rules be created in host’s FW config ? Are there any ways to setup FW restrictions on KVM/QEMU itself ? What’s the proper recipe for this use case ?

Regards
Artūras B.

[vgaetera (Vladislav Grigoryev)]

@arturasb

no network access to F37 host

When guest is configured with NAT forwarding over virbr0, guest to host access is restricted by default, but some essential services are allowed, see:

sudo firewall-cmd --info-zone=libvirt

@arturasb

Should FW rules be created in host’s FW config ?

This is possible.

@arturasb

Are there any ways to setup FW restrictions on KVM/QEMU itself ?

That is also possible.

@arturasb

What’s the proper recipe for this use case ?

It is reasonable to use firewalld since it is already involved and easier to troubleshoot.

[arturasb]

Thanks @vgaetera , I’ll study what you shared.