Differences

This shows you the differences between two versions of the page.

--- linux:apps:kvm:kvm-hardening [2026/09/13 15:24] – oscar
+++ linux:apps:kvm:kvm-hardening [2026/09/16 16:31] (current) – [Network containing] oscar
@@ Line 67: / Line 67: @@
 -------------------------------------------------------
-!/bin/bash
+#!/bin/bash
 set -euo pipefail
-VM_NAME="Debian13-ESP32-ARMHF"
+NFT="/usr/sbin/nft"
-VM_MAC="52:54:00:7e:d3:ee"
+VM_NAME="$1"
+VM_MAC=$(/usr/bin/virsh domiflist "$1" | awk '/:[0-9a-fA-F]/ {print $5}')
 LIBVIRT_BRIDGE="virbr0"
-ALLOWED_IPV4="192.168.178.1"
+HOST_INTERFACE="enp2s0"
+BLOCKED_IPV4_RANGES="{ 192.168.0.0/16 }"
-NFT="/usr/sbin/nft"
+BLOCKED_IPV6_RANGES="{ 2001:1c00:2e07:fa0a::/64, fdaa:66:67::/48 }"
 TABLE="vm_filter"
 CHAIN="vm_${VM_NAME//[^a-zA-Z0-9_]/_}"
@@ Line 86: / Line 85: @@
     "$NFT" delete table inet "$TABLE" 2>/dev/null || true
     "$NFT" add table inet "$TABLE"
-    "$NFT" add chain inet "$TABLE" "$CHAIN" \
+    "$NFT" add chain inet "$TABLE" "$CHAIN" '{ type filter hook forward priority -300; policy accept; }'
-        '{ type filter hook forward priority -300; policy accept; }'
+    # Allow established and related return traffic
+    "$NFT" add rule inet "$TABLE" "$CHAIN" ct state established,related accept
     # Allow only VM -> 192.168.178.1
-    "$NFT" add rule inet "$TABLE" "$CHAIN" \
+     "$NFT" add rule inet "$TABLE" "$CHAIN" ether saddr "$VM_MAC" ip daddr "$BLOCKED_IPV4_RANGES" drop
-        iifname "$LIBVIRT_BRIDGE" \
+     "$NFT" add rule inet "$TABLE" "$CHAIN" ether saddr "$VM_MAC" ip6 daddr "$BLOCKED_IPV6_RANGES" drop
-        ether saddr "$VM_MAC" \
-        ip daddr "$ALLOWED_IPV4" \
-        accept
-    # Drop everything else originating from this VM.
+    # ALLOW remaining traffic from the VM out to the internet via enp2s0
-    # This includes IPv4 and IPv6.
+    "$NFT" add rule inet "$TABLE" "$CHAIN" ether saddr "$VM_MAC" oifname "$HOST_INTERFACE" accept
-    "$NFT" add rule inet "$TABLE" "$CHAIN" \
-        iifname "$LIBVIRT_BRIDGE" \
-        ether saddr "$VM_MAC" \
-        drop
 }
 remove_rules()
 {
@@ Line 137: / Line 132: @@
 Check if the firewall settings are created and removed with:
   # nft list ruleset
+The firewall settings will look something like:
+```
+table inet vm_filter {
+	chain vm_Debian13_ESP {
+		type filter hook forward priority raw; policy accept;
+		ct state established,related accept
+		ether saddr 51:44:60:7e:d3:fe ip daddr 192.168.0.0/16 drop
+		ether saddr 51:44:60:7e:d3:fe ip6 daddr { 2001:1c00:2e07:fa0a::/64, fdaa:66:67::/48 } drop
+		ether saddr 51:44:60:7e:d3:fe oifname "enp2s0" accept
+	}
+}
+```
 ## Kernel Samepage Merging (KSM)