- # generate firewall rules for OpenVZ containers
- foreach my $vmid (keys %{$vmdata->{openvz}}) {
- eval {
- my $conf = $vmdata->{openvz}->{$vmid};
-
- my $vmfw_conf = $vmfw_configs->{$vmid};
- return if !$vmfw_conf;
-
- generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf);
-
- if ($vmfw_conf->{options}->{enable}) {
- if ($conf->{ip_address} && $conf->{ip_address}->{value}) {
- my $ip = $conf->{ip_address}->{value};
- $ip =~ s/\s+/,/g;
-
- my @ips = ();
-
- foreach my $singleip (split(',', $ip)) {
- my $singleip_ver = parse_address_list($singleip); # make sure we have a valid $ip list
- push @{$cluster_conf->{ipset}->{venet0}}, { cidr => $singleip };
- push @ips, $singleip if $singleip_ver == $ipversion;
- }
-
- if (scalar(@ips)) {
- my $ip_list = join(',', @ips);
- generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip_list, 'IN', $ipversion);
- generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip_list, 'OUT', $ipversion);
- }
- }
- }
-
- if ($conf->{netif} && $conf->{netif}->{value}) {
- my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value});
- foreach my $netid (keys %$netif) {
- my $d = $netif->{$netid};
- my $bridge = $d->{bridge};
- next if !$bridge || $bridge !~ m/^vmbr\d+(v(\d+))?f$/; # firewall enabled ?
- my $macaddr = $d->{mac};
- my $iface = $d->{host_ifname};
- generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
- $vmfw_conf, $vmid, 'IN', $ipversion);
- generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
- $vmfw_conf, $vmid, 'OUT', $ipversion);
+ # generate firewall rules for LXC containers
+ foreach my $vmid (keys %{$vmdata->{lxc}}) {
+ eval {
+ my $conf = $vmdata->{lxc}->{$vmid};
+ my $vmfw_conf = $vmfw_configs->{$vmid};
+ return if !$vmfw_conf;
+
+ generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf);
+
+ if ($vmfw_conf->{options}->{enable}) {
+ foreach my $netid (keys %$conf) {
+ next if $netid !~ m/^net(\d+)$/;
+ my $net = PVE::LXC::parse_lxc_network($conf->{$netid});
+ next if !$net->{firewall};
+ my $iface = "veth${vmid}i$1";
+ my $macaddr = $net->{hwaddr};
+ generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, 'IN', $ipversion);
+ generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, 'OUT', $ipversion);