[pve-devel] [PATCH 1/4] bypass firewall for non firewall bridges

[Dietmar Maurer]

> -A FORWARD -i fwbr+ -j PVEFW-FORWARD
> -A FORWARD -i vnet0 -m set --match-set PVEFW-vnet0ipset src -j PVEFW-
> FORWARD
> -A FORWARD -o vnet0 -m set --match-set PVEFW-vnet0ipset dst -j PVEFW-
> FORWARD

Most CTs only have one IP, so it is not worth to start using ipsets now (I want to
release something ASAP, so please keep things simple for now). 

> -A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
> -A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> -A PVEFW-FORWARD -m physdev --physdev-in link+ -j PVEFW-FWBR-IN
> -A PVEFW-FORWARD -o vnet0 -j PVEFW-FWBR-IN
>       -A PVEFW-FWBR-IN -p tcp -j PVEFW-tcpflags
>       -A PVEFW-FWBR-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-
> smurfs
>       -A PVEFW-FWBR-IN -m physdev --physdev-out tap123i0 --physdev-is-
> bridged -j tap123i0-IN
>       -A PVEFW-FWBR-IN -m physdev --physdev-out veth0.0 --physdev-is-
> bridged -j veth0.0-IN
>       -A PVEFW-FWBR-IN -o venet0 -d 192.168.3.104 -j venet0-104-OUT
> 
> -A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-out link+ -
> j PVEFW-FWBR-OUT
> -A PVEFW-FORWARD -i vnet0 -j PVEFW-FWBR-OUT
>       -A PVEFW-FWBR-OUT -m physdev --physdev-in tap123i0 -j tap123i0-OUT
>       -A PVEFW-FWBR-OUT -m physdev --physdev-in veth0.0  -j veth0.0-OUT
>       -A PVEFW-FWBR-OUT -i venet0 -s 192.168.3.104 -j venet0-104-OUT
> 
> 
> what do you think about it ?

looks clumsy to me - I want to use something similar as PVEFW-FWBR-IN/PVEFW-FWBR-OUT