Firewall on OVN networks
What the distributed firewall does the same way on OVN-backed networks, what differs in behaviour, and what the console shows for them.
What works the same
Policies, groups, services and profiles are one set of objects for every kind of network. A rule written once applies to network adapters on host-bridge networks and on OVN-backed networks, and a group can hold adapters of both kinds. The four categories, the order of evaluation, the first match, the action Pass, the action Reject, rule logging, stateful and stateless policies, the modes Off, Monitor and Enforce, and default profiles behave the same. The built-in objects reach OVN adapters in the same way: the baseline of a profile through the profile, the block of outbound mail through the group of blocked adapters, and an emergency bypass through the host. A network adapter whose network has port security off is kept at the mode Off and shown as Unprotected on both kinds of network.
What the console shows
When the operator has switched on OVN logical networks for the controller, the tab Firewall of a virtual machine lists adapters on OVN-backed networks next to adapters on host-bridge networks, with the same mode, profile and effective rules. Without OVN logical networks, an adapter on a distributed port group has no link and the firewall does not list it. The hosts report log records and monitor reports for their OVN adapters like any other host. The column Hits counts the rules that apply to OVN adapters only when the operator has set up the controller to read the OVN flow statistics; otherwise such a rule shows n/a. The console does not offer that setting; see Configuration.
Differences in behaviour
The table lists what differs once a host enforces the rules of an OVN-backed network. Everything that is not listed behaves as on a host-bridge network.
| Topic | Host-bridge network | OVN-backed network |
|---|---|---|
| Packet that Monitor would drop | Forwarded and reported. After the switch to Enforce, an open connection continues as a reply until it ends. | Forwarded and counted as a connection. At the switch to Enforce the host forgets the tracked connections of the adapter. A connection then continues once its next packet is allowed as a new connection; a packet from the other side that comes first is checked against the enforced inbound rules. |
| Invalid packets and replies of blocked connections in Monitor | Forwarded and reported. | Dropped before any rule is evaluated. |
| Monitor report | One entry per would-be drop. | One entry for each packet that starts a connection, made by the host from the log line of the rule. The report and its proposal are used in the same way. |
| Answer to a rejected packet | A TCP reset for TCP, and an ICMP message "administratively prohibited" for other traffic. | A TCP reset for TCP, port unreachable for UDP, and host unreachable for a ping over IPv4. |
| Router advertisements from a guest | Dropped. | Dropped only when malformed; a well-formed advertisement is delivered. |
| Multicast and broadcast | Connection state is kept. | Connection state is not kept; rules still apply. |
| Flow limit per bridge | Applies. | Does not apply. The limit on tracked connections per adapter applies to both. |
| Isolation of tenants on a private network | Built in. | Not applied automatically. |
| Hit counters | Per rule and host. | Per rule and host, when the controller reads the OVN flow statistics. |
When an adapter on an OVN-backed network moves from Monitor to Enforce, the host forgets the adapter's tracked connections, so plan the switch for a quiet period and keep the confirmation timer.
Preconditions on hosts that run OVN
A host that runs OVN reserves connection-tracking zones of its own. Before the first adapter of such a host leaves the mode Off, the zone range of OVN must end below the zones of the firewall. Until it does, the host firewalls no adapter and the tab Realization shows the state Precondition not met with the message The OVN connection-tracking zone range must end below the firewall zones. Owner action: set ct-zone-range on the host, then restart the agent. The console does not offer this host setting. The owner of the host sets it and restarts the agent, as described in Configuration.
Related tasks
- Firewall concepts explains the model that both kinds of network share.
- Rollout to existing virtual machines moves adapters through the modes.
- Realization shows the state per host.
- Tenant isolation describes the isolation on private networks.
Version 0.1. Last changed: 2026-11-14