From c5a10084b3661fc4410fb97210e2f156bf0890e3 Mon Sep 17 00:00:00 2001 From: Mira Limbeck Date: Thu, 30 Apr 2020 12:26:41 +0200 Subject: [PATCH] fix #2686: don't add arp-ip-src filter for dhcp When the IPFilter setting is enabled and the container has DHCP configured on an interface no 'arp-ip-src' filter should be added as we don't have an IP address. Previously '--arp-ip-src dhcp' was passed to ebtables which led to an error. Signed-off-by: Mira Limbeck --- src/PVE/Firewall.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index d22b15a..250a642 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -3904,7 +3904,9 @@ sub compile_ebtables_filter { # ebtables changes this to a .0/MASK network but we just # want the address here, no network - see #2193 $ip =~ s|/(\d+)$||; - push @$arpfilter, $ip; + if ($ip ne 'dhcp') { + push @$arpfilter, $ip; + } } generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter); } -- 2.39.2