MaxKellermann/ferm

broute table is not flushed

532910 opened this issue · 2 comments

532910 commented

Steps to reproduce:

  1. clear broute table:
# ebtables -t broute -F
# ebtables -t broute -L
Bridge table: broute

Bridge chain: BROUTING, entries: 0, policy: ACCEPT
  1. update ferm configuration, add:
domain eb table broute chain BROUTING {
    daddr $PrinterMAC DROP;
}

and restart ferm, rule will appear, as expected:

# ebtables -t broute -L      
Bridge table: broute

Bridge chain: BROUTING, entries: 1, policy: ACCEPT
-d PrinterMAC -j DROP
  1. undo step 2 and restart ferm, the rule will remain:
# ebtables -t broute -L      
Bridge table: broute

Bridge chain: BROUTING, entries: 1, policy: ACCEPT
-d PrinterMAC -j DROP
MaxKellermann commented

That's because ferm will only touch tables which are mentioned in the configuration.

532910 commented

That's because ferm will only touch tables which are mentioned in the configuration.

It is not true!

switching from
table filter chain INPUT proto tcp dport ssh ACCEPT;
to
table nat chain PREROUTING proto tcp DNAT daddr 10.11.11.8 dport 10 to 10.11.11.2;
will remove ssh rure even filter table is not described more.