update libvirt script with optional iptables rules

bin/start_libvirt.sh

@@ -5,6 +5,7 @@
 VIRSH_CMD="virsh -c qemu:///system"
 NET_NAME="default"
 LIBVIRT_CIDR=192.168.122.0/24
+ADD_IPTABLES_RULES=false
 
 
 if [ $UID -ne 0 ]; then
@@ -19,22 +20,27 @@ start_libvirt() {
 		$VIRSH_CMD net-start $NET_NAME
 	fi
 
-	# allow DNS for libvirt
+	if [ ${ADD_IPTABLES_RULES} = true ]; then
-	iptables -A INPUT -d $LIBVIRT_CIDR -p udp -m udp --dport 53 -j ACCEPT
+		# allow DNS for libvirt
-	iptables -A OUTPUT -s $LIBVIRT_CIDR -p udp -m udp --sport 53 -j ACCEPT
+		iptables -A INPUT -d $LIBVIRT_CIDR -p udp -m udp --dport 53 -j ACCEPT
+		iptables -A OUTPUT -s $LIBVIRT_CIDR -p udp -m udp --sport 53 -j ACCEPT
 
-	# allow SSH for libvirt
+		# allow SSH for libvirt
-	iptables -A INPUT -d $LIBVIRT_CIDR -p tcp -m tcp --sport 22 -j ACCEPT
+		iptables -A INPUT -d $LIBVIRT_CIDR -p tcp -m tcp --sport 22 -j ACCEPT
-	iptables -A OUTPUT -s $LIBVIRT_CIDR -p tcp -m tcp --dport 22 -j ACCEPT
+		iptables -A OUTPUT -s $LIBVIRT_CIDR -p tcp -m tcp --dport 22 -j ACCEPT
+	fi
 }
 
 cleanup () {
 	echo "exiting"
 	$VIRSH_CMD net-destroy $NET_NAME
 	systemctl stop libvirtd.socket
-	systemctl stop libvirtd
+	systemctl stop libvirtd virtlogd virtlogd.socket virtlockd virtlockd.socket
-	# reset default nftables
+
-	nft -f /etc/nftables.conf
+	if [ ${ADD_IPTABLES_RULES} = true ]; then
+		# reset default nftables
+		nft -f /etc/nftables.conf
+	fi
 }
 
 # call cleanup function on exit signal