<html><head><meta http-equiv="Content-Type" content="text/html charset=GB2312"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>hi,Dietmar, Alexandre</div><div><br></div><div>when I tested firewall for a vm, have a problem. some rules as follows: </div><div><br></div><div>¡...</div><div>exists tap101i0-IN (BTEOhWV/v+Zl6CQWeg2ZJDm8Vbk)</div><div> -A tap101i0-IN -p udp --dport 68 --sport 67 -j ACCEPT</div><div> -A tap101i0-IN -j PVEFW-Drop</div><div> -A tap101i0-IN -j NFLOG --nflog-prefix ":101:7:tap101i0-IN: policy DROP: "</div><div> -A tap101i0-IN -j DROP</div><div>exists tap101i0-OUT (x7NhU3mpqGhLeZq46V3iXxrU25E)</div><div> -A tap101i0-OUT -p udp --dport 67 --sport 68 -g PVEFW-SET-ACCEPT-MARK</div><div> -A tap101i0-OUT -m mac ! --mac-source 76:A4:04:1D:4F:BE -j DROP</div><div> -A tap101i0-OUT -j MARK --set-mark 0</div><div> -A tap101i0-OUT -g PVEFW-SET-ACCEPT-MARK</div><div>exists tap101i1-IN (7PKojdznbQ+5daSJnZK2atU9BHY)</div><div> -A tap101i1-IN -p udp --dport 68 --sport 67 -j ACCEPT</div><div> <font color="#ff4144">-A tap101i1-IN -m set --match-set PVEFW-0-testnet src -j ACCEPT</font></div><div> -A tap101i1-IN -j PVEFW-Drop</div><div> -A tap101i1-IN -j NFLOG --nflog-prefix ":101:7:tap101i1-IN: policy DROP: "</div><div> -A tap101i1-IN -j DROP</div><div>exists tap101i1-OUT (TmXwL3AjUtJkFHtwoEVqon/JArQ)</div><div> -A tap101i1-OUT -p udp --dport 67 --sport 68 -g PVEFW-SET-ACCEPT-MARK</div><div> -A tap101i1-OUT -m mac ! --mac-source CA:24:FC:72:CE:EC -j DROP</div><div> -A tap101i1-OUT -j MARK --set-mark 0</div><div> -A tap101i1-OUT -g PVEFW-SET-ACCEPT-MARK</div><div>¡¡</div><div><br></div><div><br></div><div>why for tap101i0-IN have no this rule:</div><div>¡¡.<span class="Apple-tab-span" style="white-space:pre"> </span></div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>-A tap101i0-IN -m set --match-set PVEFW-0-testnet src -j ACCEPT</div><div>¡¡.</div><div><br></div><div>#this vm conf:</div><div><div>balloon: 2048</div><div>bootdisk: virtio0</div><div>cores: 4</div><div>cpuunits: 10000</div><div>hotplug: 1</div><div>memory: 4096</div><div>name: test2</div><div>net0: virtio=76:A4:04:1D:4F:BE,bridge=vmbr1,tag=40,firewall=1</div><div>net1: virtio=CA:24:FC:72:CE:EC,bridge=vmbr1,tag=3009,firewall=1</div><div>onboot: 0</div><div>ostype: l26</div><div>sockets: 1</div><div>virtio0: c051401:vm-101-disk-1,size=32G</div></div><div><br></div><div>I have tested it a few times(disable firewall for net0 and reenable firewall for net0,and shutdown this vm ,also the same wrong.)</div><div>bug for the second vm rule is correct:</div><div>¡...</div><div><div>exists tap103i0-IN (qR3fhxLpBwau+mwYpGORriUkchU)</div><div> -A tap103i0-IN -p udp --dport 68 --sport 67 -j ACCEPT</div><div> <font color="#ff4144">-A tap103i0-IN -m set --match-set PVEFW-0-testnet src -j ACCEPT</font></div><div> -A tap103i0-IN -j PVEFW-Drop</div><div> -A tap103i0-IN -j NFLOG --nflog-prefix ":103:7:tap103i0-IN: policy DROP: "</div><div> -A tap103i0-IN -j DROP</div><div>exists tap103i0-OUT (gjMtlzzvQKkF68JPWemW8Qu2fJ8)</div><div> -A tap103i0-OUT -p udp --dport 67 --sport 68 -g PVEFW-SET-ACCEPT-MARK</div><div> -A tap103i0-OUT -m mac ! --mac-source CE:60:6C:FB:81:4F -j DROP</div><div> -A tap103i0-OUT -j MARK --set-mark 0</div><div> -A tap103i0-OUT -g PVEFW-SET-ACCEPT-MARK</div><div>exists tap103i1-IN (68gAcGFOIN2RENZVA38EeZlG8tQ)</div><div> -A tap103i1-IN -p udp --dport 68 --sport 67 -j ACCEPT</div><div> <font color="#ff4144">-A tap103i1-IN -m set --match-set PVEFW-0-testnet src -j ACCEPT</font></div><div> -A tap103i1-IN -j PVEFW-Drop</div><div> -A tap103i1-IN -j NFLOG --nflog-prefix ":103:7:tap103i1-IN: policy DROP: "</div><div> -A tap103i1-IN -j DROP</div><div>exists tap103i1-OUT (FeGjbt3klifLfGifM/M1okkEWAQ)</div><div> -A tap103i1-OUT -p udp --dport 67 --sport 68 -g PVEFW-SET-ACCEPT-MARK</div><div> -A tap103i1-OUT -m mac ! --mac-source 9E:1B:EB:D9:25:91 -j DROP</div><div> -A tap103i1-OUT -j MARK --set-mark 0</div><div> -A tap103i1-OUT -g PVEFW-SET-ACCEPT-MARK</div></div><div>¡...</div><div><br></div><div>there, if i use ping from 103i0 to 101i0, get error: Request timed out</div><div><br></div><div>where are something wrong for me?</div><div><br></div><div>thanks you!</div></body></html>