[pve-devel] pve-firewall: container problem

[Dietmar Maurer]

I really wonder if we can simply forbid to assign an IP to a bridge.
Instead we force the user to add an additional veth device to the
bridge, so he can configure the IP on that interface.

That idea is from http://shorewall.net/bridge-Shorewall-perl.html

What do you think about that?

> >>Any idea how to handle that?
> 
> Don't have checked openvz for the moment.
> I'll try to do tests this week
> 
> ----- Mail original -----
> 
> De: "Dietmar Maurer" <dietmar at proxmox.com>
> À: "Alexandre DERUMIER (aderumier at odiso.com)"
> <aderumier at odiso.com>, pve-devel at pve.proxmox.com
> Envoyé: Mardi 4 Mars 2014 16:13:15
> Objet: pve-firewall: container problem
> 
> Seems we cannot filter traffic from containers to KVM VM correctly:
> 
> venet => vmbrX/tapXiY
> 
> because of the known physdev match restrictions.
> 
> Any idea how to handle that?