added the 'ipfilter' option

[pve-firewall.git] / src / PVE / API2 / Firewall / VM.pm

diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm
index aad973bb33e2fe9bedeb886845d995be9725935f..192737a4c06c027a2f14b8bc7c4df537115eb36a 100644 (file)
--- a/src/PVE/API2/Firewall/VM.pm
+++ b/src/PVE/API2/Firewall/VM.pm
@@ -38,6 +38,15 @@ my $option_properties = {
        type => 'boolean',
        optional => 1,
     },
+    ipfilter => {
+       description => "Enable default IP filters. " .
+          "This is equivalent to adding an empty ipfilter-net<id> ipset " .
+          "for every interface. Such ipsets implicitly contain sane default " .
+          "restrictions such as restricting IPv6 link local addresses to " .
+          "the one derived from the interface's MAC address.",
+       type => 'boolean',
+       optional => 1,
+    },
     policy_in => {
        description => "Input policy.",
        type => 'string',