From 29728dbf830b99ac1c299980c3d3cdda9333e45e Mon Sep 17 00:00:00 2001 From: Stefan Hanreich Date: Fri, 19 Apr 2024 11:42:34 +0200 Subject: [PATCH] firewall: add handling for new nft firewall When the nftables firewall is enabled, we do not need to create firewall bridges. Signed-off-by: Stefan Hanreich [ TL: use a more meaningful variable name and add a comment ] Signed-off-by: Thomas Lamprecht --- vm-network-scripts/pve-bridge | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/vm-network-scripts/pve-bridge b/vm-network-scripts/pve-bridge index 85997a03..299be1f3 100755 --- a/vm-network-scripts/pve-bridge +++ b/vm-network-scripts/pve-bridge @@ -6,6 +6,7 @@ use warnings; use PVE::QemuServer; use PVE::Tools qw(run_command); use PVE::Network; +use PVE::Firewall; my $have_sdn; eval { @@ -44,13 +45,16 @@ die "unable to get network config '$netid'\n" my $net = PVE::QemuServer::parse_net($netconf); die "unable to parse network config '$netid'\n" if !$net; +# The nftable-based implementation from the newer proxmox-firewall does not requires FW bridges +my $create_firewall_bridges = $net->{firewall} && !PVE::Firewall::is_nftables(); + if ($have_sdn) { PVE::Network::SDN::Vnets::add_dhcp_mapping($net->{bridge}, $net->{macaddr}, $vmid, $conf->{name}); PVE::Network::SDN::Zones::tap_create($iface, $net->{bridge}); - PVE::Network::SDN::Zones::tap_plug($iface, $net->{bridge}, $net->{tag}, $net->{firewall}, $net->{trunks}, $net->{rate}); + PVE::Network::SDN::Zones::tap_plug($iface, $net->{bridge}, $net->{tag}, $create_firewall_bridges, $net->{trunks}, $net->{rate}); } else { PVE::Network::tap_create($iface, $net->{bridge}); - PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, $net->{firewall}, $net->{trunks}, $net->{rate}); + PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, $create_firewall_bridges, $net->{trunks}, $net->{rate}); } exit 0; -- 2.39.5