From b21aca2c22c5be52866043fcaf9662ca5f3f2da6 Mon Sep 17 00:00:00 2001 From: Dietmar Maurer Date: Tue, 4 Mar 2014 11:46:24 +0100 Subject: [PATCH] clear mark when entering tapXZY-OUT chain --- src/PVE/Firewall.pm | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 9afddd0..14f57b7 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -908,9 +908,11 @@ sub generate_tap_rules_direction { ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate INVALID -j DROP"); ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); - if ($direction eq 'OUT' && defined($macaddr) && - !(defined($options->{macfilter}) && $options->{macfilter} == 0)) { - ruleset_addrule($ruleset, $tapchain, "-m mac ! --mac-source $macaddr -j DROP"); + if ($direction eq 'OUT') { + if (defined($macaddr) && !(defined($options->{macfilter}) && $options->{macfilter} == 0)) { + ruleset_addrule($ruleset, $tapchain, "-m mac ! --mac-source $macaddr -j DROP"); + } + ruleset_addrule($ruleset, $tapchain, "-j MARK --set-mark 0"); # clear mark } foreach my $rule (@$rules) { -- 2.39.2