From: Ben Pfaff Date: Mon, 16 Jul 2012 22:13:22 +0000 (-0700) Subject: INSTALL.userspace: Explain how and why to use iptables to drop packets. X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff_plain;h=f4ef95344b607537f95d865fa4526688557802b4 INSTALL.userspace: Explain how and why to use iptables to drop packets. Reported-by: Ed Maste Signed-off-by: Ben Pfaff --- diff --git a/INSTALL.userspace b/INSTALL.userspace index 6e6fcd49..10511b16 100644 --- a/INSTALL.userspace +++ b/INSTALL.userspace @@ -47,6 +47,19 @@ ovs-vswitchd will create a TAP device as the bridge's local interface, named the same as the bridge, as well as for each configured internal interface. +Firewall Rules +-------------- + +On Linux, when a physical interface is in use by the userspace +datapath, packets received on the interface still also pass into the +kernel TCP/IP stack. This can cause surprising and incorrect +behavior. You can use "iptables" to avoid this behavior, by using it +to drop received packets. For example, to drop packets received on +eth0: + + iptables -A INPUT -i eth0 -j DROP + iptables -A FORWARD -i eth0 -j DROP + Bug Reporting -------------