[pve-devel] optimize non-firewalled vms rules with devgroup

[Dietmar Maurer]

> 
> So, at begin of vmbrxxx, we just need to add:
> 
> 
> -A vmbrxxx-IN -m devgroup --src-group name NOFWTAPS -j ACCEPT

> -A vmbrxxx-OUT -m devgroup --src-group name NOFWTAPS -g PVEFW-SET-
> ACCEPT-MARK
> 
> 
> 
> (I don't have tested it yet)
> 
> 
> What do you think about it ?

This is just an optimization? If so, feel free to add after testing.