Re: [Libvir] [PATCH] Re: iptables masquerade rule overexpansive

2008-03-27 Thread Daniel P. Berrange
On Thu, Mar 27, 2008 at 03:35:54PM -0500, Charles Duffy wrote: > Daniel P. Berrange wrote: > >Instead of having the separate ACCEPT rule I think it would be sufficient > >to replace the 0.0.0.0/0 target with ! 192.168.65.0/24, eg > > > >iptables -t nat -A POSTROUTING > >--source 1

Re: [Libvir] [PATCH] Re: iptables masquerade rule overexpansive

2008-03-27 Thread Daniel P. Berrange
On Thu, Mar 27, 2008 at 03:35:54PM -0500, Charles Duffy wrote: > Daniel P. Berrange wrote: > >Instead of having the separate ACCEPT rule I think it would be sufficient > >to replace the 0.0.0.0/0 target with ! 192.168.65.0/24, eg > > > >iptables -t nat -A POSTROUTING > >--source 1

[Libvir] [PATCH] Re: iptables masquerade rule overexpansive

2008-03-27 Thread Charles Duffy
Daniel P. Berrange wrote: Instead of having the separate ACCEPT rule I think it would be sufficient to replace the 0.0.0.0/0 target with ! 192.168.65.0/24, eg iptables -t nat -A POSTROUTING --source 192.168.65.0/24 --destination ! 192.168.65.0/24