To provide persistent internet connectivity to libvirt virtual machines on a host system where Docker's firewall rules are active. This configuration resolves the conflict where Docker's FORWARD DROP policy blocks VM traffic.
The solution consists of two essential parts:
- Packet Forwarding: Creating high-priority firewall rules to explicitly allow traffic from the VM network (
virbr0) to pass through the host's firewall. - Network Address Translation (NAT): Enabling masquerading on the
libvirtfirewall zone so that the VM's private IP address is translated to the host's IP address for communication with the internet.