>>No, this is a miss-understanding. >> >>We need separate GROUP-IN and GROUP-OUT rules.
Ok :) >>My question was if we should allow to apply them independently. >>Currently, a VM can only use GROUP-IN for example. >> >>got it? No, sorry :( with my patches, we could already apply GROUP-IN in TAP-IN, and GROUP-OUT in TAP-OUT only difference between out/in group was, -j PVEFW-BRIDGE-IN or -j ACCEPT. (Not that with mark, it's improved, because we can jump directly to -j VMBRX-IN) About your patches, iptables-restore hanging here for me: -A tap110i0-IN -m mark --mark 1 -g vmbr1-IN any idea ? (settings mark in other chains works fine) ----- Mail original ----- De: "Dietmar Maurer" <[email protected]> À: "Alexandre DERUMIER" <[email protected]> Cc: [email protected] Envoyé: Mercredi 19 Février 2014 09:51:15 Objet: RE: [pve-devel] pvefw security group question > (But finally, you create GROUP-IN and GROUP-OUT rules ? I thinked you > wanted common group rules) No, this is a miss-understanding. We need separate GROUP-IN and GROUP-OUT rules. My question was if we should allow to apply them independently. Currently, a VM can only use GROUP-IN for example. got it? _______________________________________________ pve-devel mailing list [email protected] http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
