+ # generate firewall rules for OpenVZ containers
+ foreach my $vmid (keys %{$vmdata->{openvz}}) {
+ my $conf = $vmdata->{openvz}->{$vmid};
+
+ my $vmfw_conf = $vmfw_configs->{$vmid};
+ next if !$vmfw_conf;
+ next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0);
+
+ if ($conf->{ip_address} && $conf->{ip_address}->{value}) {
+ my $ip = $conf->{ip_address}->{value};
+ generate_venet_rules_direction($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, 'IN');
+ generate_venet_rules_direction($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, 'OUT');
+ }
+
+ if ($conf->{netif} && $conf->{netif}->{value}) {
+ my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value});
+ foreach my $netid (keys %$netif) {
+ my $d = $netif->{$netid};
+ my $bridge = $d->{bridge};
+ if (!$bridge) {
+ warn "no bridge device for CT $vmid iface '$netid'\n";
+ next; # fixme?
+ }
+
+ generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table);
+
+ my $macaddr = $d->{host_mac};
+ my $iface = $d->{host_ifname};
+ generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN');
+ generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT');
+ }
+ }
+ }
+
+ # fixme: this is an optimization? if so, we should also drop INVALID packages?
+ ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
+
+ # fixme: what log level should we use here?
+ my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
+
+ # fixme: should we really block inter-bridge traffic?
+
+ # always allow traffic from containers?
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j RETURN");
+
+ # disable interbridge routing
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j PVEFW-Drop");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j PVEFW-Drop");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
+
+ return wantarray ? ($ruleset, $hostfw_conf) : $ruleset;