[pve-devel] [RFC container/firewall/manager/proxmox-firewall/qemu-server 00/37] proxmox firewall nftables implementation

[Stefan Hanreich]

On 4/3/24 08:05, DERUMIER, Alexandre via pve-devel wrote:
> Personnaly, I'm not sure than using reject / tcp-reset in a bridged is
> a good idea.  (Even if personally I'm using it production, I don't have
> problem to switch to DROP, if I can avoid other problems)

Yes, I tend to agree. But there certainly will be users who want to use
REJECT for guest firewalls and it certainly makes sense to support that
- especially since we have supported it since the beginning. It's hard
to take away features. I also feel like this is something a firewall
should support one way or another and if it's not there we are missing a
really basic feature.


> Maybe it is time to disable dynamic mac-learning  by default ? 
> The code is already here and works fine.
> 
> AFAIK, other hypervisor like vmware disable port flooding by default
> with static mac registration too.

Might be a good idea, although it still wouldn't solve the problem -
sadly (since we're still not allowed to do REJECT then).