> >>I would not rely on that. We need a way to correctly update rules without > relying on previous state. > > Ok, I'll send a patch to generale the whole firewall rules. > I don't think it'll be slow anyway. (and no more iptables_exist, so it can be > more reliable too)
Wait. Maybe we can optimize/fix your way. (I guess it would be great if we can update FW rules for single VM, or single security groups.) My idea is to do a 'iptables-save' first, and parse that output to see what chains exist. Maybe we can compute MD5sum to see if something changed? _______________________________________________ pve-devel mailing list [email protected] http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
