On 05/11/2011 05:53 PM, David Stevens wrote:
>
> Can you run a VM and do a 'ebtables -t nat -L' and post the output.
> I'd be curious how
> the chains look like now with the 'clean-traffic' filter without
> having to apply the
> patches and test them.
<two stages -- before DHCP ACK and after below>
Bridge table: nat
Bridge chain: PREROUTING, entries: 1, policy: ACCEPT
-i vnet0 -j libvirt-I-vnet0
Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT
-o vnet0 -j libvirt-O-vnet0
Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT
-j I-vnet0-mac
-p IPv4 -j I-vnet0-ipv4
Ideally the rule '-p IPv4 -j ACCEPT' would come right after this one so
we don't need to step across all the ARP-related ones. Primarily with
IPv4 this would be a concern, less with ARP.
-p ARP -j I-vnet0-arpmac
-p ARP -j I-vnet0-arpip
... and if possible right here the -p ARP -j ACCEPT would follow.
-p 0x8035 -j I-vnet0-rarp
-p 0x835 -j ACCEPT
-p IPv4 -j ACCEPT
-p ARP -j ACCEPT
-j DROP
This helps. Please post this as part of future introductions to patches.
Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT
-p IPv4 -j O-vnet0-ipv4
Also here -p IPv4 -j ACCEPT.
Stefan
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
