Libvirterror internal error failed to initialize a valid firewall backend - Исправление ошибок и поиск оптимальных решений проблем

I’m trying to set up a virtual NAT network device without DHCP for libvirt on an Arch Linux host.

What I have tried:

# virsh net-define network.xml 
Network default defined from network.xml

[network.xml]:

<network>
  <name>default</name>
  <bridge name="maas0" />
  <forward mode="nat" />
  <ip address="10.137.0.1" netmask="255.255.255.0" />
</network>

My laptop outputs the following on start-up:

# virsh net-start default
error: Failed to start network default
error: internal error: Failed to initialize a valid firewall backend

All other threads concerning this topic are talking about upgrading software — I’m using the most current versions:

$ pacman -Q ebtables dnsmasq libvirt iptables
ebtables 2.0.10_4-5
dnsmasq 2.75-1
libvirt 1.3.3-1
iptables 1.4.21-3

What could be the reason for that internal error and what can I do against?

Ramhound

40.4k34 gold badges100 silver badges127 bronze badges

asked Apr 9, 2016 at 0:03

Installing ebtables and dnsmasq seems to fix the problem. Don’t forget to restart the libvirtd service.

The commands:

sudo pacman -Syu ebtables dnsmasq
sudo systemctl restart libvirtd

NOTE: do not forget to close and re-open your virt-manager GUI (if you’re using one).

EDIT: The original answer suggested also installing firewalld. This doesn’t seem to be necessary for many users, and may add an additional unwanted firewall to your system. However if you want to try it, you can add the following commands as well:

sudo pacman -Syu firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld
sudo systemctl restart libvirtd

Phil

2461 gold badge2 silver badges12 bronze badges

answered Jun 18, 2016 at 13:58

This is the error that comes up if libvirtd was started without ebtables and/or dnsmasq installed. If you’ve got them installed and you’re still having this issue, you probably need to restart the libvirtd service:

sudo systemctl restart libvirtd.service

Credit to the comments on the other answer to this question for illuminating this. I’m submitting it as a new and separate answer to the original question because installing and starting firewalld to solve the original problem is liable to cause new problems: once the firewall daemon is running, most of the services you’ll want within your virtual machine, including DHCP, will be blocked by default, meaning that your VMs will not be able to reach the network on initialization.

I lost over an hour of my life trying to track down this problem, and tracing it to a firewall I had just enabled was one of the dumbest sources of a bug that I’ve ever run into. Don’t let it take any time from yours.

answered Sep 24, 2018 at 2:51

As I am not able yet to add an additional comment to the most upvoted answer, I had to add this solution as a new answer instead.

In some cases, users might not want to replace iptables with iptables-nft as it might break existing rules.

The legacy iptables package contains ebtables-nft which is a symlink to xtables-nft-multi.

You can check this using file:

$ file $(which ebtables-nft)
/usr/bin/iptables: symbolic link to xtables-nft-multi

A simple solution is to create the missing symlinks so libvirt/virt-manager can find it without touching existing packages on your system.

$ ln -s /usr/bin/xtables-nft-multi /usr/bin/ebtables
$ ln -s /usr/bin/xtables-nft-multi /usr/bin/ebtables-save
$ ln -s /usr/bin/xtables-nft-multi /usr/bin/ebtables-restore

Restart the libvirt daemons/sockets (whatever you use) afterwards and the networks should start without the firewall backend error.

answered Jan 3, 2022 at 0:49

Источник

Receiving an error ‘failed to initialize a valid firewall backend’ while trying to create Virtual Machines on KVM using Libvirt? You are at the right place to find a solution.

Here at Bobcares, we have seen several such KVM related errors as part of our Server Management Services for web hosts and online service providers.

Today we will take a look at the cause for this error and see how to fix it.

What does ‘failed to initialize a valid firewall backend’ error mean

Normally, you come across this error message while creating Virtual Machines on KVM using Libvirt.

Often, this error occurs as a result of missed dependency during the KVM installation on Linux. That is if you start libvirtd without installing ebtables and/or dnsmasq.

However, in some cases, you might have already installed them, but still, you face the same issue. This can occur if you have not restarted the libvirtd service.

How we resolve the error ‘failed to initialize a valid firewall backend’

Now let us take a look at how our Support Engineers resolve this error message.

In order to resolve this error, we install iptables, dnsmasq, and ebtables packages. Here is its installation command.

$ sudo pacman -S ebtables iptables dnsmasq

Then you can check package details by running the below command.

$ sudo pacman -Qi ebtables iptables dnsmasq

Once the installation completes, you would need to restart the libvirtd service.

$ sudo sudo systemctl restart libvirtd

In case, if you have Virtual Machine Manager running then close it and then try to re-open.

You can test it by checking your active Qemu networks. For that, run the below command.

$ virsh net-list –all

Now try to start a network and it must be successful. Here is the command for it.

$ virsh net-start vagrant-libvirt
Network vagrant-libvirt started

This must fix the error message.

[Need any further assistance with KVM related errors? – We are here to help you.]

Conclusion

In short, this error occurs while creating Virtual Machines on KVM using Libvirt. Today, we saw how our Support Engineers resolve this error.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED

var google_conversion_label = «owonCMyG5nEQ0aD71QM»;

Источник

Hi all,

I am not quite sure if this is a bug, a config change or a package dependency related story.
Nevertheless, I will post my findings and hopefully through a discussion we can find the truth behind this.

Today 2018/09/29 I updated my desktop pc and it is up2date at current moment.

Libvirt 4.7.0-1 couldnt create bridge interfaces and add the appropriate firewall rules.
Further investigation into the matter showed me a peculiar error virNetDevSendEthtoolIoctl : ethtool ioctl error: No such device
but the virt-manager was complained for Failed to initialize a valid firewall backend so I guessed that these are probably two separated problems.

Below you can find my full investigation. My conclusions are that the latest version of libvirtd needs both ebtables & firewalld although I would love not to use firewalld.

Kernel , libvirt & Qemu/kvm Version

 ~$ uname -a
Linux myhomepc 4.14.72-1-lts #1 SMP Wed Sep 26 12:31:03 CEST 2018 x86_64 GNU/Linux

 ~$ pacman -Qi libvirt  | egrep ^Version
Version         : 4.7.0-1

 ~$ pacman -Qi qemu | egrep ^Version
Version         : 3.0.0-2

No Firewalld or ebtables

 ~$ pacman -Q | egrep -i 'firewalld|ebtables'

No Bridges

 ~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::96de:80ff:fexx:xxxx/64 scope link 

       valid_lft forever preferred_lft forever

 ~$ sudo brctl show

No firewall

 ~$ sudo iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         


 ~$ systemctl status iptables
● iptables.service - Packet Filtering Framework
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
   Active: inactive (dead) since Sat 2018-09-29 12:08:44 EEST; 1h 4min ago
 Main PID: 495 (code=exited, status=0/SUCCESS)

Sep 29 12:08:44 myhomepc systemd[1]: Stopping Packet Filtering Framework...
Sep 29 12:08:44 myhomepc iptables-flush[1479]: /usr/bin/iptables
Sep 29 12:08:44 myhomepc systemd[1]: Stopped Packet Filtering Framework.

No running services:

~$ ps -e fuwww | egrep -i 'dnsmasq|qemu|virt'
ebal      8839  0.0  0.0   8188  2408 pts/1    S+   13:14   0:00                  |   |   _ grep -E -i dnsmasq|qemu|virt



 ~$ systemctl status libvirtd
● libvirtd.service - Virtualization daemon
   Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; disabled; vendor preset: disabled)
   Active: inactive (dead) since Sat 2018-09-29 13:07:06 EEST; 1min 37s ago
     Docs: man:libvirtd(8)
           https://libvirt.org
  Process: 8434 ExecStart=/usr/bin/libvirtd $LIBVIRTD_ARGS (code=exited, status=0/SUCCESS)
 Main PID: 8434 (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 32768)
   Memory: 5.5M
   CGroup: /system.slice/libvirtd.service

Sep 29 13:07:06 myhomepc systemd[1]: Stopping Virtualization daemon...
Sep 29 13:07:06 myhomepc systemd[1]: Stopped Virtualization daemon.



 ~$ systemctl status virtlockd.socket
● virtlockd.socket - Virtual machine lock manager socket
   Loaded: loaded (/usr/lib/systemd/system/virtlockd.socket; disabled; vendor preset: disabled)
   Active: active (listening) since Sat 2018-09-29 12:05:22 EEST; 1h 3min ago
   Listen: /var/run/libvirt/virtlockd-sock (Stream)
   CGroup: /system.slice/virtlockd.socket

Sep 29 13:09:22 myhomepc systemd[1]: Closed Virtual machine lock manager socket.

So basically a very clean archlinux box

Starting services

 ~$ sudo systemctl restart iptables
 ~$ sudo systemctl restart virtlogd.socket 
 ~$ sudo systemctl restart libvirtd

No virtual bridge !

 ~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.3/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::96de:80ff:fexx:xxxx/64 scope link 

       valid_lft forever preferred_lft forever

 ~$ sudo brctl show

errors on Journaclt

 ~$ sudo journalctl  -u libvirtd | tail

Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.535+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.777+0000: 8907: error : virFirewallApply:902 : internal error: Failed to initialize a valid firewall backend
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.826+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.827+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.829+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.830+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.831+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.832+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.833+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device
Sep 29 13:16:29 myhomepc libvirtd[8890]: 2018-09-29 10:16:29.835+0000: 8912: error : virNetDevSendEthtoolIoctl:3077 : ethtool ioctl error: No such device

Install ebtables & firewalld

~$ sudo pacman -S ebtables firewalld 
resolving dependencies...
looking for conflicting packages...

Package (6)                 New Version  Net Change

extra/python-dbus           1.2.8-2        0.53 MiB
extra/python-dbus-common    1.2.8-2        8.18 MiB
community/python-decorator  4.3.0-2        0.04 MiB
community/python-slip       0.6.5-2        0.12 MiB
extra/ebtables              2.0.10_4-6     0.23 MiB
community/firewalld         0.6.2-1        4.68 MiB

Total Installed Size:  13.78 MiB

:: Proceed with installation? [Y/n] y
(6/6) checking keys in keyring                                                                              [----------------------------------------------------------------] 100%
(6/6) checking package integrity                                                                            [----------------------------------------------------------------] 100%
(6/6) loading package files                                                                                 [----------------------------------------------------------------] 100%
(6/6) checking for file conflicts                                                                           [----------------------------------------------------------------] 100%
(6/6) checking available disk space                                                                         [----------------------------------------------------------------] 100%
:: Processing package changes...
(1/6) installing ebtables                                                                                   [----------------------------------------------------------------] 100%
(2/6) installing python-decorator                                                                           [----------------------------------------------------------------] 100%
(3/6) installing python-dbus-common                                                                         [----------------------------------------------------------------] 100%
(4/6) installing python-dbus                                                                                [----------------------------------------------------------------] 100%
(5/6) installing python-slip                                                                                [----------------------------------------------------------------] 100%
(6/6) installing firewalld                                                                                  [----------------------------------------------------------------] 100%
Optional dependencies for firewalld
    bash-completion: bash completion [installed]
    ebtables: old backend [installed]
    gtk3: firewall-config [installed]
    ipset: old backend
    iptables: old backend [installed]
    libnm-glib: firewall-config and firewall-applet
    libnotify: firewall-applet [installed]
    python-pyqt5: firewall-applet
:: Running post-transaction hooks...
(1/5) Compiling GSettings XML schema files...
(2/5) Updating icon theme caches...
(3/5) Reloading system manager configuration...
(4/5) Arming ConditionNeedsUpdate...

and restart libvirtd !

~$ sudo systemctl restart libvirtd

voila !!!

~$ ip a | egrep vir
95: virbr1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    inet 192.168.42.1/24 brd 192.168.42.255 scope global virbr1
96: virbr1-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr1 state DOWN group default qlen 1000
97: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
98: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000

firewall rules in place

~$ sudo iptables -nvL | egrep virbr

    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  virbr1 virbr1  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  virbr1 virbr1  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 ACCEPT     udp  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ACCEPT     udp  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ACCEPT     udp  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ACCEPT     udp  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            udp dpt:68

https://balaskas.gr
Linux System Engineer — Registered Linux User #420129

Источник

06.09.2018

Ошибка возникает в т.ч. при выполнении команды sudo virsh net-start default т.е. при поднятии сетевого интерфейса по умолчанию в либвирте/виртменеджере.
Вот здесь хорошее начало, но нужно дополнение, кмк:
1. Из перечисленных пакетов в 2.12 нужно доставить: qemu-kvm, bridge-utils.
2. Добавить пользователя, работающего с виртменеджером в группы: kvm, libvirt.
3. Установить пакеты: ebtables, dnsmasq, dnsmasq-base.
После этого сетевой интерфейс по-умолчанию в виртменеджере поднимается без ошибок.
П.С. Решение взято отсюда, не уверен, что это правильное решение. Но помогает.