Yesterday, I’ve disabled all third-party repositories, uninstalled all extra packages (except the ones which gave me a warning), and performed a system upgrade via Discover from F41 KDE to F42 KDE. All went well, so I re-enabled the repos and installed the packages from them. There were a few hickups along the way (PIA VPN had an issue with iptables which I solved by uninstalling it, deleting all the configuration files, and then performing a clean install), but most of it works fine. With the exception of my virtual machines.
I’m using KVM/QEMU with VMM, and I can no longer establish a network connection in any of my existing VMs, nor can I get it working when I try building a new VM (with the VPN turned off). I tried uninstalling and reinstalling, but maybe I didn’t clean the configs thoroughly. I tried forcing the old backend in /etc/libvirt/network.conf to iptables but that made the KVM/QEMU not able to connect to the VMs. I then reverted to nftables and set it explicitly. I tried modifying my /etc/sysconfig/nftables.conf and making it executable. Nothing worked.
My host has no problems connecting via ethernet.
Does anyone have any suggestions before I resort to a clean OS install?
EDIT - I tried a thorough uninstall and a clean install of the @Virtualization group, flushed the nft ruleset, restarted nftables and libvirtd several times, etc. Still nothing.
If I’m forced to do a clean OS install, I think I may as well switch to a rolling-release distro, probably CachyOS.
Found the culprit and the solution. My firewall was borked by the system upgrade, so I had to reset it to its default values, but I also had to change the location for the nftables from /etc/sysconfig/nftables.conf to /etc/nftables.conf.
Couldn’t have done it without AI, which told me:
the file /etc/sysconfig/nftables.conf is the older, legacy-style config location that Fedora used before switching to /etc/nftables.conf (with systemd integration). It may still work, but it’s not guaranteed to be loaded unless explicitly referenced by your systemd unit.
TL;DR:
Fedora 42 expects/etc/nftables.conf, not /etc/sysconfig/nftables.conf.
This is what I had to do:
1. Remove your current rules:
sudo nft flush ruleset
2. Then stop nftables:
sudo systemctl stop nftables
3. Locate the current config file (mine was in /etc/sysconfig/nftables.conf):
locate nftables.conf
4. Flush old rules and disable legacy config:
sudo nft flush ruleset
sudo mv /etc/sysconfig/nftables.conf /etc/sysconfig/nftables.conf.bak
5. Create a clean /etc/nftables.conf (This config accepts all traffic (you can lock it down later) and enables NAT for your VMs via virbr0):
sudo tee /etc/nftables.conf > /dev/null <<'EOF'
#!/usr/sbin/nft -f
table inet filter {
chain input {
type filter hook input priority 0;
policy accept;
}
chain forward {
type filter hook forward priority 0;
policy accept;
}
chain output {
type filter hook output priority 0;
policy accept;
}
}
table ip nat {
chain postrouting {
type nat hook postrouting priority 100;
oifname "virbr0" masquerade
}
}
EOF
6. Create a systemd override for nftables:
sudo systemctl edit nftables
7. This opens an empty editor. Add the following:
[Service]
ExecStart=
ExecStart=/usr/sbin/nft -f /etc/nftables.conf
8. Reload and restart the service:
sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl restart nftables
9. Then check status:
sudo systemctl status nftables
My VMs now have networking.
My next step is asking AI:
you said my nftables now accept all traffic which i can lock down later. what changes should i make?
Thank you for the reply, Vladislav. It would seem that AI is (at the moment) only useful if you ask the right questions. I didn’t realize nftables don’t have to be used at all, so now I asked how I could revert to an entirely default setup, as if I performed a clean install. These were the instructions I got (btw. they work after a reboot):
On a clean Fedora 42 install, most users are protected not by a custom /etc/nftables.conf ruleset, but by the default firewall service: firewalld, which uses nftables as its backend[1]. If you want to revert to the default firewall behavior as seen on a fresh Fedora system, here’s what you should do:
TL;DR: