+ # generate firewall rules for OpenVZ containers
+ foreach my $vmid (keys %{$vmdata->{openvz}}) {
+ my $conf = $vmdata->{openvz}->{$vmid};
+
+ my $vmfw_conf = $vmfw_configs->{$vmid};
+ next if !$vmfw_conf;
+ next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0);
+
+ if ($conf->{ip_address} && $conf->{ip_address}->{value}) {
+ my $ip = $conf->{ip_address}->{value};
+ generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'IN');
+ generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'OUT');
+ }
+
+ if ($conf->{netif} && $conf->{netif}->{value}) {
+ my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value});
+ foreach my $netid (keys %$netif) {
+ my $d = $netif->{$netid};
+ my $bridge = $d->{bridge};
+ if (!$bridge) {
+ warn "no bridge device for CT $vmid iface '$netid'\n";
+ next; # fixme?
+ }
+
+ generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table);
+
+ my $macaddr = $d->{mac};
+ my $iface = $d->{host_ifname};
+ generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, $bridge, 'IN');
+ generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, $bridge, 'OUT');
+ }
+ }
+ }
+
+ if($hostfw_options->{optimize}){
+
+ my $accept = ruleset_chain_exist($ruleset, "PVEFW-IPS") ? "PVEFW-IPS" : "ACCEPT";
+ ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
+ ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate INVALID -j DROP");
+ }
+
+ # fixme: what log level should we use here?
+ my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
+
+ # fixme: should we really block inter-bridge traffic?
+
+ # always allow traffic from containers?
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j RETURN");
+
+ # disable interbridge routing
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j PVEFW-Drop");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j PVEFW-Drop");
+ ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-o vmbr+");
+ ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-i vmbr+");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
+
+ return wantarray ? ($ruleset, $hostfw_conf, $ipset_ruleset) : $ruleset;