+sub generate_nfqueue {
+ my ($options) = @_;
+
+ my $action = "";
+ if($options->{ips}){
+ $action = "NFQUEUE";
+ if($options->{ips_queues} && $options->{ips_queues} =~ m/^(\d+)(:(\d+))?$/) {
+ if(defined($3) && defined($1)) {
+ $action .= " --queue-balance $1:$3";
+ }elsif (defined($1)) {
+ $action .= " --queue-num $1";
+ }
+ }
+ $action .= " --queue-bypass";
+ }else{
+ $action = "ACCEPT";
+ }
+
+ return $action;
+}
+
+sub ruleset_generate_vm_ipsrules {
+ my ($ruleset, $options, $direction, $iface, $bridge) = @_;
+
+ if ($options->{ips} && $direction eq 'IN') {
+ my $nfqueue = generate_nfqueue($options);
+
+ if (!ruleset_chain_exist($ruleset, "$bridge-IPS")) {
+ ruleset_create_chain($ruleset, "PVEFW-IPS");
+ }
+
+ if (!ruleset_chain_exist($ruleset, "$bridge-IPS")) {
+ ruleset_create_chain($ruleset, "$bridge-IPS");
+ ruleset_insertrule($ruleset, "PVEFW-IPS", "-o $bridge -m physdev --physdev-is-out -j $bridge-IPS");
+ }
+
+ ruleset_addrule($ruleset, "$bridge-IPS", "-m physdev --physdev-out $iface --physdev-is-bridged -j $nfqueue");
+ }
+}
+