yeah, I know... that's not gonna happen any time soon in my setup... tested OpenStack, and all is 'working' until it doesn't. Then try to find out why... OTOH I like openvswitch very much, and not only for performance.
I'll define a hooks/qemu then. Had one running with some mangle marks for TC Aight, Thanks Jan On Thu, Nov 7, 2013 at 5:04 AM, Daniel P. Berrange <[email protected]>wrote: > On Wed, Nov 06, 2013 at 02:44:57PM +0100, Jan De Landtsheer wrote: > > Hello, > > I _was_ trying to set up an nwfilter for our networking set-up with VXLAN > > and openvswitch, where we use VXLAN as carrier for separate networks > > (unlike OpenStack gre-tunnels). > > > > But with OVS, ebtables do not work, and the basic setup of nwfilter rules > > are based on this premise... or so I understand... > > > > Now.. > > Is there a way to define nwfilter rules _without_ ebtables ? > > > > What I would like to do is quite simple (block out dhcp{4,6} services > from > > VM's, and ipv6 router advertisements ) > > There's no support for nwfilter at all when using openvswitch, due to > the kernel limitations you mention. The (disgusting) way openstack deals > with this is to create a traditional bridge per vm so you have > > > phys nic <-> openvswitch > \---> vm bridge <-> vm tap dev > \---> vm bridge <-> vm tap dev > \---> vm bridge <-> vm tap dev > > Daniel > -- > |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/:| > |: http://libvirt.org -o- http://virt-manager.org:| > |: http://autobuild.org -o- http://search.cpan.org/~danberr/:| > |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc:| >
-- libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
