On 05/11/2011 05:53 PM, David Stevens wrote:
Can you run a VM and do a 'ebtables -t nat -L' and post the output. I'd be curious how the chains look like now with the 'clean-traffic' filter without having to apply the patches and test them.
<two stages -- before DHCP ACK and after below>
Bridge table: nat
Bridge chain: PREROUTING, entries: 1, policy: ACCEPT -i vnet0 -j libvirt-I-vnet0
Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT -o vnet0 -j libvirt-O-vnet0
Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT -j I-vnet0-mac -p IPv4 -j I-vnet0-ipv4
Ideally the rule '-p IPv4 -j ACCEPT' would come right after this one so we don't need to step across all the ARP-related ones. Primarily with IPv4 this would be a concern, less with ARP.
-p ARP -j I-vnet0-arpmac -p ARP -j I-vnet0-arpip
... and if possible right here the -p ARP -j ACCEPT would follow.
-p 0x8035 -j I-vnet0-rarp -p 0x835 -j ACCEPT -p IPv4 -j ACCEPT -p ARP -j ACCEPT -j DROP
This helps. Please post this as part of future introductions to patches.
Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4
Also here -p IPv4 -j ACCEPT. Stefan