[pve-devel] pve-firewall : iptables V2

[Dietmar Maurer]

> >>I would not rely on that. We need a way to correctly update rules without
> relying on previous state.
> 
> Ok, I'll send a patch to generale the whole firewall rules.
> I don't think it'll be slow anyway. (and no more iptables_exist, so it can be
> more reliable too)

Wait. Maybe we can optimize/fix your way.

(I guess it would be great if we can update FW rules for single VM, or single security groups.)

My idea is to do a 'iptables-save' first, and parse that output to see what chains exist.
Maybe we can compute MD5sum to see if something changed?