开启安全组功能并新建虚拟机,在VM的host上,Iptables的Filter表的INPUT链以及FORWARD将增加一些默认的规则:
注:在该规则下,虚拟机内部是ping不通默认网关的,下一篇文章将分析具体的原因。
*filter
:INPUT ACCEPT [390091:77291625]
-A INPUT -j neutron-openvswi-INPUT
:INPUT ACCEPT [390091:77291625]
:neutron-openvswi-INPUT - [0:0]
-A neutron-openvswi-INPUT -m physdev --physdev-in tap93cb6698-b1 --physdev-is-bridged -j neutron-openvswi-o93cb6698-b
## 网桥接收到数据包,数据包是从 tap93cb6698-b1 这个网桥端口收到的,并且这个包是桥接过来的,未被路由过,则转到 neutron-openvswi-o93cb6698-b 链## 实际上,对于INPUT链, --physdev-is-bridged 这个条件是无效的,那为何还需要加上这个条件?
## 说明:
physdev
This module matches on the bridge port input and output devices enslaved to a bridge device.
This module is a part of the infrastructure that enables a transparent bridging IP firewall and is
only useful for kernel versions above version 2.5.44.
[!] --physdev-is-bridged
Matches if the packet is being bridged and therefore is not being routed. This is only useful in theFORWARD and POSTROUTINGchains.