mirror of
https://git.proxmox.com/git/proxmox-firewall
synced 2025-10-04 04:47:33 +00:00
de75183366
In order to make sure we are only affecting VM traffic and no host interfaces that are bridged, move the rules into a chain that gets executed inside the guest chain, rather than setting the rules globally. Since ether type matches on the respective Ethernet header, it doesn't work for packets with VLAN header. Matching via meta protocol ensures that VLAN encapsulated ARP packets are matched as well. Otherwise ARP traffic inside VLANs gets dropped, due to them having conntrack state invalid. Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com> Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> |
||
|---|---|---|
| .cargo | ||
| debian | ||
| proxmox-firewall | ||
| proxmox-nftables | ||
| proxmox-ve-config | ||
| .gitignore | ||
| Cargo.toml | ||
| defines.mk | ||
| Makefile | ||