From 556ae5c18f597f525a9d6c7e9b44e64978acd78c Mon Sep 17 00:00:00 2001 From: Alexandre Derumier Date: Thu, 2 May 2019 07:04:16 +0200 Subject: [PATCH] fix #2193: arpfilter: CT: remove mask from net ip cidr. We need to send to ebtables an host address without prefix or with /32 prefix. Signed-off-by: Alexandre Derumier --- src/PVE/Firewall.pm | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 806fd4b..e679127 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -3782,7 +3782,10 @@ sub compile_ebtables_filter { push(@$arpfilter, $ip); } } - push(@$arpfilter, $net->{ip}) if $net->{ip} && $vmfw_conf->{options}->{ipfilter}; + if($net->{ip} && $vmfw_conf->{options}->{ipfilter}) { + $net->{ip} =~ s|/(\d+)$||; + push(@$arpfilter, $net->{ip}); + } generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter); } }; -- 2.39.2