Hello, I _was_ trying to set up an nwfilter for our networking set-up with VXLAN and openvswitch, where we use VXLAN as carrier for separate networks (unlike OpenStack gre-tunnels). But with OVS, ebtables do not work, and the basic setup of nwfilter rules are based on this premise... or so I understand... Now.. Is there a way to define nwfilter rules _without_ ebtables ? What I would like to do is quite simple (block out dhcp{4,6} services from VM's, and ipv6 router advertisements )

On Wed, Nov 06, 2013 at 02:44:57PM +0100, Jan De Landtsheer wrote: > Hello, > I _was_ trying to set up an nwfilter for our networking set-up with VXLAN > and openvswitch, where we use VXLAN as carrier for separate networks > (unlike OpenStack gre-tunnels). > > But with OVS, ebtables do not work, and the basic setup of nwfilter rules > are based on this premise... or so I understand... > > Now.. > Is there a way to define nwfilter rules _without_ ebtables ? > > What I would like to do is quite simple (block out dhcp{4,6} services from > VM's, and ipv6 router advertisements ) There's no support for nwfilter at all when using openvswitch, due to the kernel limitations you mention. The (disgusting) way openstack deals with this is to create a traditional bridge per vm so you have phys nic <-> openvswitch \---> vm bridge <-> vm tap dev \---> vm bridge <-> vm tap dev \---> vm bridge <-> vm tap dev

Why not use ovs-ofctl add-flow for this? Translate iptables rules to openflow flows not very hard.... 2013/11/7 Laine Stump <laine(a)laine.org&gt;: > On 11/07/2013 06:04 AM, Daniel P. Berrange wrote: >> On Wed, Nov 06, 2013 at 02:44:57PM +0100, Jan De Landtsheer wrote: >>> Hello, >>> I _was_ trying to set up an nwfilter for our networking set-up with VXLAN >>> and openvswitch, where we use VXLAN as carrier for separate networks >>> (unlike OpenStack gre-tunnels). >>> >>> But with OVS, ebtables do not work, and the basic setup of nwfilter rules >>> are based on this premise... or so I understand... >>> >>> Now.. >>> Is there a way to define nwfilter rules _without_ ebtables ? >>> >>> What I would like to do is quite simple (block out dhcp{4,6} services from >>> VM's, and ipv6 router advertisements ) >> There's no support for nwfilter at all when using openvswitch, due to >> the kernel limitations you mention. The (disgusting) way openstack deals >> with this is to create a traditional bridge per vm so you have >> >> >> phys nic <-> openvswitch >> \---> vm bridge <-> vm tap dev >> \---> vm bridge <-> vm tap dev >> \---> vm bridge <-> vm tap dev > > It would be an "interesting exercise" to see if it was possible to write > a backend for nwfilter that used OVS flows or whatever it is they have. > My suspicion is that the configuration model used by nwfilter may be too > low level and (ip|eb)tables-specific to be mapped into a different > backend implementation, so it could require some new higher level > elements that would then need to be implemented for the (ip|eb)tables > backend as well (and the original config elements deprecated). > > -- > libvir-list mailing list > libvir-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru jabber: vase(a)selfip.ru

There's no support for nwfilter at all when using openvswitch, due to the kernel limitations you mention. The (disgusting) way openstack deals with this is to create a traditional bridge per vm so you have phys nic <-> openvswitch \---> vm bridge <-> vm tap dev \---> vm bridge <-> vm tap dev \---> vm bridge <-> vm tap dev

Because it's terribly inefficient. You may, on the other hand, view it as "clever", because it is able to work around deficiencies in the individual components to make something that works at all. It certainly is true, though, that a lot of cycles are being wasted on each packet's trip through all that network linkage, and it would sure be nice if that waste could be avoided.