[pve-devel] pvefw security group question

[Alexandre DERUMIER]

>>About your patches, iptables-restore hanging here for me: 
>>
>>-A tap110i0-IN -m mark --mark 1 -g vmbr1-IN 
>>
>>any idea ? (settings mark in other chains works fine) 

Oh, I think it's doing a loop, it should go to vmbr1-OUT

-A tap110i0-IN -m mark --mark 1 -g vmbr1-OUT



----- Mail original ----- 

De: "Alexandre DERUMIER" <aderumier at odiso.com> 
À: "Dietmar Maurer" <dietmar at proxmox.com> 
Cc: pve-devel at pve.proxmox.com 
Envoyé: Mercredi 19 Février 2014 10:21:18 
Objet: Re: [pve-devel] pvefw security group question 

>>No, this is a miss-understanding. 
>> 
>>We need separate GROUP-IN and GROUP-OUT rules. 

Ok :) 

>>My question was if we should allow to apply them independently. 
>>Currently, a VM can only use GROUP-IN for example. 
>> 
>>got it? 

No, sorry :( 

with my patches, we could already apply GROUP-IN in TAP-IN, and GROUP-OUT in TAP-OUT 

only difference between out/in group was, -j PVEFW-BRIDGE-IN or -j ACCEPT. 

(Not that with mark, it's improved, because we can jump directly to -j VMBRX-IN) 



About your patches, iptables-restore hanging here for me: 

-A tap110i0-IN -m mark --mark 1 -g vmbr1-IN 

any idea ? (settings mark in other chains works fine) 
----- Mail original ----- 

De: "Dietmar Maurer" <dietmar at proxmox.com> 
À: "Alexandre DERUMIER" <aderumier at odiso.com> 
Cc: pve-devel at pve.proxmox.com 
Envoyé: Mercredi 19 Février 2014 09:51:15 
Objet: RE: [pve-devel] pvefw security group question 

> (But finally, you create GROUP-IN and GROUP-OUT rules ? I thinked you 
> wanted common group rules) 

No, this is a miss-understanding. 

We need separate GROUP-IN and GROUP-OUT rules. 

My question was if we should allow to apply them independently. 
Currently, a VM can only use GROUP-IN for example. 

got it? 
_______________________________________________ 
pve-devel mailing list 
pve-devel at pve.proxmox.com 
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel