From ae022413700ee317f7fd84c4989b90e776d2464c Mon Sep 17 00:00:00 2001
From: MengMengCode <227010654+MengMengCode@users.noreply.github.com>
Date: Thu, 16 Jul 2026 20:57:07 +0800
Subject: [PATCH] =?UTF-8?q?KVM=E7=9A=84=E7=AB=AF=E5=8F=A3=E8=BD=AC?=
 =?UTF-8?q?=E5=8F=91=5F=20=E5=A4=B1=E6=95=88=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/lxc/portmap.go | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/backend/internal/lxc/portmap.go b/backend/internal/lxc/portmap.go
index 716d619..98d0288 100644
--- a/backend/internal/lxc/portmap.go
+++ b/backend/internal/lxc/portmap.go
@@ -252,6 +252,7 @@ func EnsureForwardRules(bridge string) {
 	if bridge == "" {
 		bridge = "lxcbr0"
 	}
+	ensureLibvirtForwardRules(bridge)
 	rules := [][]string{
 		{"-i", bridge, "-j", "ACCEPT"},
 		{"-o", bridge, "-j", "ACCEPT"},
@@ -269,6 +270,33 @@ func EnsureForwardRules(bridge string) {
 	}
 }
 
+func ensureLibvirtForwardRules(bridge string) {
+	if bridge != "virbr0" || exec.Command("iptables", "-L", "LIBVIRT_FWI", "-n").Run() != nil {
+		return
+	}
+	rules := []struct {
+		chain string
+		args  []string
+	}{
+		{chain: "LIBVIRT_FWI", args: []string{"-o", bridge, "-j", "ACCEPT"}},
+		{chain: "LIBVIRT_FWO", args: []string{"-i", bridge, "-j", "ACCEPT"}},
+		{chain: "LIBVIRT_FWX", args: []string{"-i", bridge, "-o", bridge, "-j", "ACCEPT"}},
+	}
+	for _, rule := range rules {
+		if exec.Command("iptables", "-L", rule.chain, "-n").Run() != nil {
+			continue
+		}
+		for {
+			deleteArgs := append([]string{"-D", rule.chain}, rule.args...)
+			if exec.Command("iptables", deleteArgs...).Run() != nil {
+				break
+			}
+		}
+		insertArgs := append([]string{"-I", rule.chain, "1"}, rule.args...)
+		exec.Command("iptables", insertArgs...).Run()
+	}
+}
+
 // CleanPortMappings removes all iptables rules for a container
 func (m *Manager) CleanPortMappings(id int) error {
 	tag := clicdTag(id)