mirror of
https://git.proxmox.com/git/proxmox-firewall
synced 2025-10-04 04:47:33 +00:00
3500a8d833
In order to be able to send outgoing ARP packets when the default policy is set to drop or reject, we need to explicitly allow ARP traffic in the outgoing chain of guests. We need to do this in the guest chain itself in order to be able to filter spoofed packets via the MAC filter. Contrary to the out direction we can simply accept all incoming ARP traffic, since we do not do any MAC filtering for incoming traffic. Since we create fdb entries for every NIC, guests should only see ARP traffic for their MAC addresses anyway. Originally-by: Laurent Guerby <laurent@guerby.net> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> |
||
|---|---|---|
| .cargo | ||
| debian | ||
| proxmox-firewall | ||
| proxmox-nftables | ||
| proxmox-ve-config | ||
| .gitignore | ||
| Cargo.toml | ||
| defines.mk | ||
| Makefile | ||