firehol (firewall) with bridge: how to filter
- by Leon
I have two interfaces: eth0 (public address) and lxcbr0 with 10.0.3.1.
I have a LXC guest running with ip 10.0.3.10
This is my firehol config:
version 5
trusted_ips=`/usr/local/bin/strip_comments /etc/firehol/trusted_ips`
trusted_servers=`/usr/local/bin/strip_comments /etc/firehol/trusted_servers`
blacklist full `/usr/local/bin/strip_comments /etc/firehol/blacklist`
interface lxcbr0 virtual
policy return
server "dhcp dns" accept
router virtual2internet inface lxcbr0 outface eth0
masquerade
route all accept
interface any world
protection strong
#Outgoing these protocols are allowed to everywhere
client "smtp pop3 dns ntp mysql icmp" accept
#These (incoming) services are available to everyone
server "http https smtp ftp imap imaps pop3 pop3s passiveftp" accept
#Outgoing, these protocols are only allowed to known servers
client "http https webcache ftp ssh pyzor razor" accept dst "${trusted_servers}"
On my host I can connect only to "trusted servers" on port 80. In my guest I can connect to port 80 on every host. I assumed that firehol would block that.
Is there something I can add/change so that my guest(s) inherit the rules of the eth0 interface?
