[libvirt-users] Problems getting nwfilter to work

[Marc]

Hi folks,

I'm using libvirt 3.9.0 running under CentOS 7.5. I want the guests,
which are all within the same subnet (e.g. 10.0.0.x.), only talk to
their default gateway (e.g. 10.0.0.1) but to each other. This is caused
by a design issue of our network platform. I set up a filter rule and
attached it to the interface of a guest using nwfilter-define:

<filter name='private_ip' chain='ipv4'>
  <uuid>foobar</uuid>
  <rule action='accept' direction='out' priority='100'>
    <ip srcipaddr='$IP' dstipaddr='10.0.0.1'/>
  </rule>
  <rule action='accept' direction='in' priority='110'>
    <ip srcipaddr='10.0.0.1' dstipaddr='$IP'/>
  </rule>
  <rule action='drop' direction='inout' priority='500'>
    <all/>
  </rule>
</filter>

t simply doesn't work. The guest can talk to the other guests within the
same subnet. All guests are connected to a bridge interface. The IP of
the guest interface is defined in the guests' xml file. Is there any
additional kernel module to load? The module br_netfilter is already
loaded and /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1.
After hours of googling and testing I still couldn't find a solution.
Please help!

Thank you very much in advance
Marc