only add tap rules for interface with firewall=1

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index e291b85b040187e1a3bb3244f7932a29e97062c4..56c3beb807357fd229acda7569faaea534406636 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2620,7 +2620,7 @@ sub compile {
        foreach my $netid (keys %$conf) {
            next if $netid !~ m/^net(\d+)$/;
            my $net = PVE::QemuServer::parse_net($conf->{$netid});
-           next if !$net;
+           next if !$net->{firewall};
            my $iface = "tap${vmid}i$1";
 
            my $macaddr = $net->{macaddr};