>>Maybe we can/should replace that with -g PVEFW-SET-ACCEPT-MARK? yes, it should work.
But isn't it slower (more taps(in|out) to check), than simply use -m conntrack --ctstate RELATED,ESTABLISHED -j PVE-Accept at the begin of FORWARD ? ? (I think I should do some benchmarks, maybe the difference is not so big with modern processors) ----- Mail original ----- De: "Dietmar Maurer" <[email protected]> À: "Alexandre DERUMIER" <[email protected]> Cc: [email protected] Envoyé: Jeudi 20 Mars 2014 06:55:27 Objet: RE: [pve-devel] [PATCH] add ips feature v5 > Not for conntrack > > -N tapXXXi0-OUT > -A tapXXXi0-OUT -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs -A > tapXXXi0-OUT -p udp -m udp --sport 68 --dport 67 -j PVEFW-SET-ACCEPT- > MARK -A tapXXXi0-OUT -p tcp -j PVEFW-tcpflags -A tapXXXi0-OUT -m > conntrack --ctstate INVALID -j DROP > -A tapXXXi0-OUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT >> > HERE > Maybe we can/should replace that with -g PVEFW-SET-ACCEPT-MARK? _______________________________________________ pve-devel mailing list [email protected] http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
