> The main idea is to reduce a maximum rules lookup for performance. > > 1) the forward rules are splitted by bridge, and we only check rules for tap > devices on this bridge. This reduce a lot lookups if you have a lot of bridge > (bridgevlan for example) > 2) the inter-bridge routing is dropped by default. > 3) the tap outgoing rules are always processed before incoming. We need to use > RETURN in outgoing rules, but we can use ACCEPT in incoming rules. > That good, because we can stop lookups when ACCEPT.
Looks good for me. But we need some scripts in order to test that. Maybe we can re-use code from 'pve-firewall'? _______________________________________________ pve-devel mailing list pve-devel@pve.proxmox.com http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
