[pve-devel] pvefw: masquerade problems and conntrack zones

[Dietmar Maurer]

> > isn't veth too much overhead ? (I'm a bit worried about veth
> > performance, see http://www.opencloudblog.com/?p=96)
> 
> People always compare performance of OVSIntPort with full-featured linux
> netfilter code.

BTW, do I understand the OpenStack network correctly?

1.) They use a linux bridge to apply netfilter firewall.
2.) They use an OVS bridge and plug in the linux bridge (using veth pair?)
3.) They use an (GRE) tunnel to a dedicated network host?

Not sure if that is correct, but I do not believe that is faster.