[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH 3/9] add DHCP snooping support to nwfilter



On 05/11/2011 05:53 PM, David Stevens wrote:


>
> Can you run a VM and do a 'ebtables -t nat -L' and post the output.
> I'd be curious how

> the chains look like now with the 'clean-traffic' filter without
> having to apply the

> patches and test them.

<two stages -- before DHCP ACK and after below>

Bridge table: nat

Bridge chain: PREROUTING, entries: 1, policy: ACCEPT
-i vnet0 -j libvirt-I-vnet0


Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT
-o vnet0 -j libvirt-O-vnet0


Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT
-j I-vnet0-mac
-p IPv4 -j I-vnet0-ipv4

Ideally the rule '-p IPv4 -j ACCEPT' would come right after this one so we don't need to step across all the ARP-related ones. Primarily with IPv4 this would be a concern, less with ARP.

-p ARP -j I-vnet0-arpmac
-p ARP -j I-vnet0-arpip

... and if possible right here the -p ARP -j ACCEPT would follow.

-p 0x8035 -j I-vnet0-rarp
-p 0x835 -j ACCEPT
-p IPv4 -j ACCEPT
-p ARP -j ACCEPT
-j DROP

This helps. Please post this as part of future introductions to patches.


Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT
-p IPv4 -j O-vnet0-ipv4

Also here -p IPv4 -j ACCEPT.

   Stefan


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]