What I'm tryna doing

I'm trying to set up a virtual NAT network device without DHCP for libvirt on an Arch Linux host.

What I've done so far

# virsh net-define network.xml 
Network default defined from network.xml


  <bridge name="maas0" />
  <forward mode="nat" />
  <ip address="" netmask="" />

Why I hate my laptop

Because it outputs the following on start-up:

# virsh net-start default
error: Failed to start network default
error: internal error: Failed to initialize a valid firewall backend

All other threads concerning this topic are talking about upgrading software -- I'm using the most current versions:

$ pacman -Q ebtables dnsmasq libvirt iptables
ebtables 2.0.10_4-5
dnsmasq 2.75-1
libvirt 1.3.3-1
iptables 1.4.21-3

My question

What could be the reason of that internal error and what can I do against? (Thanks.)


Installing ebtables, firewalld and dnsmasq seems to fix the problem. Don't forget to start firewalld and also to restart the libvirtd service.

The commands:

sudo pacman -Syu ebtables dnsmasq firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld
sudo systemctl restart libvirtd

NOTE: do not forget to close and re-open your virt-manager GUI (if you're using one).

  • 10
    There's no need to install firewalld, it's also not listed on ArchLinux wiki, it's just necessary to start ebtables and dnsmasq, with libvirtd/virtlogd afterwards. – pepper_chico Jan 1 '18 at 17:51
  • 6
    I want to emphasize, restart libvirtd, after installing ebtables and dnsmasq – ThorSummoner Aug 27 '18 at 0:18

This is the error that comes up if libvirtd was started without ebtables and/or dnsmasq installed. If you've got them installed and you're still having this issue, you probably need to restart the libvirtd service:

sudo systemctl restart libvirtd.service

Credit to the comments on the other answer to this question for illuminating this. I'm submitting it as a new and separate answer to the original question because installing and starting firewalld to solve the original problem is liable to cause new problems: once the firewall daemon is running, most of the services you'll want within your virtual machine, including DHCP, will be blocked by default, meaning that your VMs will not be able to reach the network on initialization.

I lost over an hour of my life trying to track down this problem, and tracing it to a firewall I had just enabled was one of the dumbest sources of a bug that I've ever run into. Don't let it take any time from yours.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.