Re: [libvirt] Libvirt, nwfilter, openvswitch

Why not use ovs-ofctl add-flow for this? Translate iptables rules to openflow flows not very hard.... 2013/11/7 Laine Stump <laine(a)laine.org&gt;: > On 11/07/2013 06:04 AM, Daniel P. Berrange wrote: >> On Wed, Nov 06, 2013 at 02:44:57PM +0100, Jan De Landtsheer wrote: >>> Hello, >>> I _was_ trying to set up an nwfilter for our networking set-up with VXLAN >>> and openvswitch, where we use VXLAN as carrier for separate networks >>> (unlike OpenStack gre-tunnels). >>> >>> But with OVS, ebtables do not work, and the basic setup of nwfilter rules >>> are based on this premise... or so I understand... >>> >>> Now.. >>> Is there a way to define nwfilter rules _without_ ebtables ? >>> >>> What I would like to do is quite simple (block out dhcp{4,6} services from >>> VM's, and ipv6 router advertisements ) >> There's no support for nwfilter at all when using openvswitch, due to >> the kernel limitations you mention. The (disgusting) way openstack deals >> with this is to create a traditional bridge per vm so you have >> >> >> phys nic <-> openvswitch >> \---> vm bridge <-> vm tap dev >> \---> vm bridge <-> vm tap dev >> \---> vm bridge <-> vm tap dev > > It would be an "interesting exercise" to see if it was possible to write > a backend for nwfilter that used OVS flows or whatever it is they have. > My suspicion is that the configuration model used by nwfilter may be too > low level and (ip|eb)tables-specific to be mapped into a different > backend implementation, so it could require some new higher level > elements that would then need to be implemented for the (ip|eb)tables > backend as well (and the original config elements deprecated). > > -- > libvir-list mailing list > libvir-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru jabber: vase(a)selfip.ru