maxLength => 20,
});
+PVE::JSONSchema::register_standard_option('pve-fw-loglevel' => {
+ description => "Log level.",
+ type => 'string',
+ enum => ['emerg', 'alert', 'crit', 'err', 'warning', 'notice', 'info', 'debug', 'nolog'],
+ optional => 1,
+});
+
my $security_group_pattern = '[A-Za-z][A-Za-z0-9\-\_]+';
PVE::JSONSchema::register_standard_option('pve-security-group-name', {
push @cmd, "-m iprange --dst-range $dest";
} else {
- push @cmd, "-s $dest";
+ push @cmd, "-d $dest";
}
}
my $options = $hostfw_conf->{options};
my $cluster_options = $cluster_conf->{options};
my $rules = $hostfw_conf->{rules};
+ my $cluster_rules = $cluster_conf->{rules};
# host inbound firewall
my $chain = "PVEFW-HOST-IN";
# we use RETURN because we need to check also tap rules
my $accept_action = 'RETURN';
- foreach my $rule (@$rules) {
+ # add host rules first, so that cluster wide rules can be overwritten
+ foreach my $rule (@$rules, @$cluster_rules) {
next if $rule->{type} ne 'in';
ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf);
}
# we use RETURN because we may want to check other thigs later
$accept_action = 'RETURN';
- foreach my $rule (@$rules) {
+ # add host rules first, so that cluster wide rules can be overwritten
+ foreach my $rule (@$rules, @$cluster_rules) {
next if $rule->{type} ne 'out';
ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf);
}