From f4ef95344b607537f95d865fa4526688557802b4 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Mon, 16 Jul 2012 15:13:22 -0700 Subject: [PATCH] INSTALL.userspace: Explain how and why to use iptables to drop packets. Reported-by: Ed Maste Signed-off-by: Ben Pfaff --- INSTALL.userspace | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/INSTALL.userspace b/INSTALL.userspace index 6e6fcd49..10511b16 100644 --- a/INSTALL.userspace +++ b/INSTALL.userspace @@ -47,6 +47,19 @@ ovs-vswitchd will create a TAP device as the bridge's local interface, named the same as the bridge, as well as for each configured internal interface. +Firewall Rules +-------------- + +On Linux, when a physical interface is in use by the userspace +datapath, packets received on the interface still also pass into the +kernel TCP/IP stack. This can cause surprising and incorrect +behavior. You can use "iptables" to avoid this behavior, by using it +to drop received packets. For example, to drop packets received on +eth0: + + iptables -A INPUT -i eth0 -j DROP + iptables -A FORWARD -i eth0 -j DROP + Bug Reporting ------------- -- 2.30.2