<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
On 05/11/2011 05:53 PM, David Stevens wrote:
<blockquote
cite="mid:OF42D99131.37A905B4-ON8825788D.0075B589-8825788D.007842A4@us.ibm.com"
type="cite">
<meta http-equiv="Context-Type" content="text/html;
charset=US-ASCII">
<p><tt></tt><br>
<tt>> <br>
> Can you run a VM and do a 'ebtables -t nat -L' and post
the output. <br>
> I'd be curious how</tt><br>
<tt>> the chains look like now with the 'clean-traffic'
filter without <br>
> having to apply the</tt><br>
<tt>> patches and test them.</tt><br>
<br>
<tt><two stages -- before DHCP ACK and after below></tt><br>
<tt> </tt><br>
<tt>Bridge table: nat</tt><br>
<br>
<tt>Bridge chain: PREROUTING, entries: 1, policy: ACCEPT<br>
-i vnet0 -j libvirt-I-vnet0</tt><br>
<br>
<tt>Bridge chain: OUTPUT, entries: 0, policy: ACCEPT</tt><br>
<br>
<tt>Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT<br>
-o vnet0 -j libvirt-O-vnet0</tt><br>
<br>
<tt>Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT<br>
-j I-vnet0-mac<br>
-p IPv4 -j I-vnet0-ipv4<br>
</tt></p>
</blockquote>
Ideally the rule '-p IPv4 -j ACCEPT' would come right after this one
so we don't need to step across all the ARP-related ones. Primarily
with IPv4 this would be a concern, less with ARP.<br>
<br>
<blockquote
cite="mid:OF42D99131.37A905B4-ON8825788D.0075B589-8825788D.007842A4@us.ibm.com"
type="cite">
<p><tt>
-p ARP -j I-vnet0-arpmac<br>
-p ARP -j I-vnet0-arpip<br>
</tt></p>
</blockquote>
... and if possible right here the -p ARP -j ACCEPT would follow.<br>
<blockquote
cite="mid:OF42D99131.37A905B4-ON8825788D.0075B589-8825788D.007842A4@us.ibm.com"
type="cite">
<p><tt>
-p 0x8035 -j I-vnet0-rarp<br>
-p 0x835 -j ACCEPT <br>
-p IPv4 -j ACCEPT <br>
-p ARP -j ACCEPT <br>
-j DROP </tt><br>
</p>
</blockquote>
This helps. Please post this as part of future introductions to
patches.<br>
<br>
<blockquote
cite="mid:OF42D99131.37A905B4-ON8825788D.0075B589-8825788D.007842A4@us.ibm.com"
type="cite">
<p>
<br>
<tt>Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT<br>
-p IPv4 -j O-vnet0-ipv4<br>
</tt></p>
</blockquote>
Also here -p IPv4 -j ACCEPT.<br>
<br>
Stefan<br>
<br>
</body>
</html>