On 4/3/24 08:05, DERUMIER, Alexandre via pve-devel wrote: > Personnaly, I'm not sure than using reject / tcp-reset in a bridged is > a good idea. (Even if personally I'm using it production, I don't have > problem to switch to DROP, if I can avoid other problems) Yes, I tend to agree. But there certainly will be users who want to use REJECT for guest firewalls and it certainly makes sense to support that - especially since we have supported it since the beginning. It's hard to take away features. I also feel like this is something a firewall should support one way or another and if it's not there we are missing a really basic feature. > Maybe it is time to disable dynamic mac-learning by default ? > The code is already here and works fine. > > AFAIK, other hypervisor like vmware disable port flooding by default > with static mac registration too. Might be a good idea, although it still wouldn't solve the problem - sadly (since we're still not allowed to do REJECT then). _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
- [pve-devel] [PATCH proxmox-firewall 22/3... Stefan Hanreich
- [pve-devel] [PATCH proxmox-firewall 25/3... Stefan Hanreich
- [pve-devel] [PATCH proxmox-firewall 31/3... Stefan Hanreich
- Re: [pve-devel] [RFC container/firewall/... Laurent GUERBY
- Re: [pve-devel] [RFC container/fire... Stefan Hanreich
- Re: [pve-devel] [RFC container/firewall/... DERUMIER, Alexandre via pve-devel
- Re: [pve-devel] [RFC container/fire... Stefan Hanreich
- Re: [pve-devel] [RFC container/fire... Stefan Hanreich
- Re: [pve-devel] [RFC container/firewall/... DERUMIER, Alexandre via pve-devel
- Re: [pve-devel] [RFC container/firewall/... DERUMIER, Alexandre via pve-devel
- Re: [pve-devel] [RFC container/fire... Stefan Hanreich
- Re: [pve-devel] [RFC container/... DERUMIER, Alexandre via pve-devel
- Re: [pve-devel] [RFC contai... Stefan Hanreich
- Re: [pve-devel] [RFC co... DERUMIER, Alexandre via pve-devel
- Re: [pve-devel] [R... Stefan Hanreich
- Re: [pve-devel] [RFC container/firewall/... Stefan Hanreich
- Re: [pve-devel] [RFC container/firewall/... Lukas Wagner
- Re: [pve-devel] [RFC container/fire... Stefan Hanreich
- Re: [pve-devel] [RFC container/... Thomas Lamprecht
- Re: [pve-devel] [RFC contai... Stefan Hanreich