Am 18/04/2024 um 18:14 schrieb Stefan Hanreich:
> When the nftables firewall is enabled, we do not need to create
> firewall bridges.
>
> Signed-off-by: Stefan Hanreich
> ---
> vm-network-scripts/pve-bridge | 9 +++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/vm-network-scripts/pve-bridge b/vm-network-scripts/pve-bridge
> index 85997a0..ac2eb3b 100755
> --- a/vm-network-scripts/pve-bridge
> +++ b/vm-network-scripts/pve-bridge
> @@ -6,6 +6,7 @@ use warnings;
> use PVE::QemuServer;
> use PVE::Tools qw(run_command);
> use PVE::Network;
> +use PVE::Firewall;
>
> my $have_sdn;
> eval {
> @@ -44,13 +45,17 @@ die "unable to get network config '$netid'\n"
> my $net = PVE::QemuServer::parse_net($netconf);
> die "unable to parse network config '$netid'\n" if !$net;
>
> +my $cluster_fw_conf = PVE::Firewall::load_clusterfw_conf();
> +my $host_fw_conf = PVE::Firewall::load_hostfw_conf($cluster_fw_conf);
> +my $firewall = $net->{firewall} && !($host_fw_conf->{options}->{nftables} //
> 0);
we could add a helper for this in PVE::Firewall to make this and the container
one a bit shorter, while it's not much we'd have to bump firewall anyway, so
not a high cost to do.
> +
> if ($have_sdn) {
> PVE::Network::SDN::Vnets::add_dhcp_mapping($net->{bridge},
> $net->{macaddr}, $vmid, $conf->{name});
> PVE::Network::SDN::Zones::tap_create($iface, $net->{bridge});
> -PVE::Network::SDN::Zones::tap_plug($iface, $net->{bridge}, $net->{tag},
> $net->{firewall}, $net->{trunks}, $net->{rate});
> +PVE::Network::SDN::Zones::tap_plug($iface, $net->{bridge}, $net->{tag},
> $firewall, $net->{trunks}, $net->{rate});
> } else {
> PVE::Network::tap_create($iface, $net->{bridge});
> -PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag},
> $net->{firewall}, $net->{trunks}, $net->{rate});
> +PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, $firewall,
> $net->{trunks}, $net->{rate});
> }
>
> exit 0;
___
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
