use iptables rules in the FORWARD chain (beware undesirable
interactions with bridged IP traffic through bridge-nf if enabled vith
sysctl net.bridge.bridge-nf-call-iptables=1).
I think I'm doing that anyway. For every VM that is started, a strict
set of iptables rules are set up which only allow traffic in/out of
specific interfaces (using physdev). The rules also prevent ip spoofing.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
