From c5191f576871ac92b2b87aeca6e5777714b6cf1c Mon Sep 17 00:00:00 2001 From: Dietmar Maurer Date: Wed, 21 May 2014 06:00:11 +0200 Subject: [PATCH] do not use ctstate in corosync rule That is not necessary, because we only reach that rule if ctstate is NEW. --- src/PVE/Firewall.pm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index eea47f2..c80664f 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -1712,7 +1712,7 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 22 -j $accept_action"); # SSH # corosync - my $corosync_rule = "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j $accept_action"; + my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action"; ruleset_addrule($ruleset, $chain, "-s $clusternet -d $clusternet $corosync_rule"); ruleset_addrule($ruleset, $chain, "-s $clusternet -m addrtype --dst-type MULTICAST $corosync_rule"); } @@ -1753,7 +1753,7 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-d $clusternet -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console ruleset_addrule($ruleset, $chain, "-d $clusternet -p tcp --dport 3128 -j $accept_action"); # SPICE Proxy - my $corosync_rule = "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j $accept_action"; + my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action"; ruleset_addrule($ruleset, $chain, "-d $clusternet $corosync_rule"); ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST $corosync_rule"); } -- 2.39.2