X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;fp=src%2FPVE%2FFirewall.pm;h=97670fd1acf4cbfbbaa2986d0ef3e31396d744e7;hp=a2105e5410590b30305bd6941ddcc8bfe40159da;hb=e410833b000d93948143957884f701abb92d0d44;hpb=70718917e677c2f431aa7cde2463cc84dc26f95b

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index a2105e5..97670fd 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1944,9 +1944,10 @@ sub ebtables_get_chains {
 	my $line = shift;
 	return if $line =~ m/^#/;
 	return if $line =~ m/^\s*$/;
-	if ($line =~ m/^:(\S+)\s\S+$/) {
+	if ($line =~ m/^:(\S+)\s(ACCEPT|DROP|RETURN)$/) {
 	    # Make sure we know chains exist even if they're empty.
 	    $chains->{$1} //= [];
+	    $res->{$1}->{policy} = $2;
 	} elsif ($line =~ m/^(?:\S+)\s(\S+)\s(?:\S+).*/) {
 	    my $chain = $1;
 	    $line =~ s/\s+$//;
@@ -4063,6 +4064,7 @@ sub get_ruleset_status {
 	if (defined($change_only_regex)) {
 	    $action = 'ignore' if ($chain !~ m/$change_only_regex/);
 	    $statushash->{$chain}->{rules} = $active_chains->{$chain}->{rules};
+	    $statushash->{$chain}->{policy} = $active_chains->{$chain}->{policy};
 	    $sig = $sig->{sig};
 	}
 	$statushash->{$chain}->{action} = $action;
@@ -4163,7 +4165,8 @@ sub get_ebtables_cmdlist {
     my $pve_include = 0;
     foreach my $chain (sort keys %$statushash) {
 	next if ($statushash->{$chain}->{action} eq 'delete');
-	$cmdlist .= ":$chain ACCEPT\n";
+	my $policy = $statushash->{$chain}->{policy} // 'ACCEPT';
+	$cmdlist .= ":$chain $policy\n";
 	$pve_include = 1 if ($chain eq 'PVEFW-FORWARD');
     }