title: How to configure firewall on Centos 7 for KVM Routed Bridge
body: <p>I want to set up multiple virtual machines to run webserver, postfix, etc.</p>
  
  <p>I have a few public IP-Adresses from my ISP. My host system is running Centos 7 and my virtual machines are running Debian Wheezy. Since my hoster restrict access to the switch based on MAC Address, I cannot use a "full" bridge.</p>
  
  <p>Instead I configured a routed bridge (<a href="http://wiki.hetzner.de/index.php/Proxmox_VE#Netzwerkkonfiguration_Hostsystem_KVM.2FRouted" rel="nofollow">see http://wiki.hetzner.de/index.php/Proxmox_VE</a>)</p>
  
  <p>I have successfully set up both machines, but the vm cannot connect to the internet if my firewall on my host machine is active. If my firewall is active I can ping machines on the internet from my vm, but nothing else.</p>
  
  <p>How can I configure my firewall under Centos 7 to give the VMs on br0 acces to internet? </p>
  
  <p>Any help is appreciated. Thank you very much.</p>
  
  <p><strong>Network Config Host Machine</strong></p>
  
  <p>Host-Machine: /etc/sysconfig/network-scripts/ifcfg-enp2s0</p>
  
  <pre><code> BOOTPROTO=none
   DEVICE=enp2s0
   ONBOOT=yes
   IPADDR=A.A.A.42
   NETMASK=255.255.255.255
   SCOPE="peer A.A.A.1"
  </code></pre>
  
  <p>Host-Machine: /etc/sysconfig/network-scripts/route-enp2s0</p>
  
  <pre><code> ADDRESS0=0.0.0.0
   NETMASK0=0.0.0.0
   GATEWAY0=A.A.A.1
  </code></pre>
  
  <p>Host-Machine: /etc/sysconfig/network-scripts/ifcfg-br0</p>
  
  <pre><code> DEVICE=br0
   TYPE="Bridge"
   ONBOOT=yes
   BOOTPROTO=none
   IPADDR=A.A.A.42
   NETMASK=255.255.255.255
   STP=off
   DELAY=0
  </code></pre>
  
  <p>Host Machine: /etc/sysconfig/network-scripts/route-br0</p>
  
  <pre><code> ADDRESS0=B.B.B.160
   NETMASK0=255.255.255.255
  </code></pre>
  
  <p><strong>Network Config Virtual machine</strong></p>
  
  <p>Virtual machine: /etc/network/interfaces</p>
  
  <pre><code> auto lo
   iface lo inet loopback
   allow-hotplug eth0
   iface eth0 inet static
           address B.B.B.160
           netmask 255.255.255.255
           pointopoint A.A.A.42
           gateway A.A.A.42
  </code></pre>
  
  <p><strong>Firewall settings Host machine</strong>
  firewall-cmd --list-all</p>
  
  <pre><code>public (default, active)
    interfaces: br0 enp2s0
    sources: 
    services: dhcpv6-client ssh
    ports: 
    masquerade: no
    forward-ports: 
    icmp-blocks: 
    rich rules: 
  </code></pre>
  
  <p>Thank you very much in advance.</p>