[pve-devel] pve-firewall : iptables V2

[Dietmar Maurer]

> you should also add theses chains to clear all
> 
> vmbrx-IN
> vmbrx-OUT
> GROUP-xxx

OK

> >>Does that makes sense?
> Yes.
> 
> But how do you remove stale chain ?
> (like a stale tap chain, because of a vm crash for example)

Oh, I do not care about crashed VM (why?).

My idea was that we simply compute the whole set of chains we need.
Then we compare that with the current ruleset, and only apply the diff (and
remove rules which are no longer needed).