<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font face="Arial">Hello People.<br>
<br>
I have produced a very simple networkfilter that is not work as I
would expect it. Perhaps one of you knows what I did wrong?<br>
<br>
I made this little filter:<br>
<filter name='my-test-no-ip-spoofing' priority='-700'><br>
<rule action='drop' direction='out' priority='-999'><br>
<all match='no' srcipaddr='$IP'/><br>
</rule><br>
</filter><br>
<br>
I could attach it directly to a VM (and defined an IP-Adress in
the network-interface there). Then it produced iptables rules that
look like this:<br>
<br>
Chain FI-vnetnn (1 references)<br>
pkts bytes target prot opt in out
source destination<br>
0 0 DROP all -- * * ! IP
0.0.0.0/0<br>
<br>
(This is the rule governing the input via the virtual device into
the bridge, is as expected.)<br>
<br>
Chain HI-vnetnn (1 references)<br>
pkts bytes target prot opt in out
source destination<br>
0 0 DROP all -- * * ! IP
0.0.0.0/0<br>
<br>
(This is the rule governing the input to the host, i would expect
this too.)<br>
<br>
Chain FO-vnetnn (1 references)<br>
pkts bytes target prot opt in out
source destination<br>
0 0 DROP all -- * * 0.0.0.0/0 !
IP<br>
<br>
This is the rule governing the output via the virtual-device from
the bridge. (i.e. Packets coming from the network.)<br>
I specifically asked to filter outgoing traffic. This one I don't
unterstand. Perhaps somebody knows a hint?<br>
<br>
On the other hand this filter works as expected, no rule on
"FO-vnetnn":<br>
<filter name='my-no-mac-spoofing' priority='-800'><br>
<rule action='drop' direction='out'><br>
<all match='no' srcmacaddr='$MAC'/><br>
</rule><br>
</filter><br>
<br>
I used libvirt with qemu on Ubuntu 13.10. (Version
1.1.1-0ubuntu8.5)<br>
<br>
I am grateful for any helpful comments.<br>
<br>
Sincerely<br>
</font><br>
<font face="\"Arial\"">Matthias Babisch<br>
IT/Organisation<br>
<br>
<b>b+m Informatik AG</b><br>
Rotenhofer Weg 20<br>
24109 Melsdorf<br>
<br>
T +49 4340/404-1444<br>
F +49 4340/404-111<br>
M +49 160/8866426<br>
<a class="moz-txt-link-abbreviated" href="mailto:matthias.babisch@bmiag.de">matthias.babisch@bmiag.de</a><br>
<br>
<font size="\"-1\"">Aktuelle Informationen unter <a
href="%5C%22http://www.bmiag.de%5C%22">www.bmiag.de</a><br>
Die b+m Informatik AG ist ein Unternehmen der <a
href="%5C%22http://www.allgeier-holding.de%5C%22">Allgeier
Gruppe</a><br>
<br>
Vorsitzender des Aufsichtsrates: Dr. Marcus Goedsche<br>
Vorstand: Dipl-Ing. Frank Mielke<br>
Amtsgericht Kiel, HRB 5526<br>
</font></font> <font face="Arial"><br>
</font>
</body>
</html>