Ideally the rule '-p IPv4 -j ACCEPT' would come right after this one so we don't need to step across all the ARP-related ones. Primarily with IPv4 this would be a concern, less with ARP.
>
> Can you run a VM and do a 'ebtables -t nat -L' and post the output.
> I'd be curious how
> the chains look like now with the 'clean-traffic' filter without
> having to apply the
> patches and test them.
<two stages -- before DHCP ACK and after below>
Bridge table: nat
Bridge chain: PREROUTING, entries: 1, policy: ACCEPT
-i vnet0 -j libvirt-I-vnet0
Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT
-o vnet0 -j libvirt-O-vnet0
Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT
-j I-vnet0-mac
-p IPv4 -j I-vnet0-ipv4
... and if possible right here the -p ARP -j ACCEPT would follow.-p ARP -j I-vnet0-arpmac
-p ARP -j I-vnet0-arpip
This helps. Please post this as part of future introductions to patches.-p 0x8035 -j I-vnet0-rarp
-p 0x835 -j ACCEPT
-p IPv4 -j ACCEPT
-p ARP -j ACCEPT
-j DROP
Also here -p IPv4 -j ACCEPT.
Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT
-p IPv4 -j O-vnet0-ipv4