all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Josef Johansson <josef@oderland.se>
To: pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [PATCH pve-common 0/2] add disable bridge learning feature
Date: Thu, 11 Nov 2021 11:46:36 +0100	[thread overview]
Message-ID: <196c3dc5-f926-55a9-661c-e7b9146c7b27@oderland.se> (raw)
In-Reply-To: <179fb53f-5dff-8d3a-38b6-a392b9bcb581@proxmox.com>

On 11/11/21 11:40, Thomas Lamprecht wrote:
> On 24.09.21 10:48, Alexandre Derumier wrote:
>> Currently, if bridge receive an unknown dest mac (network bug/attack/..),
>> we are flooding packets to all bridge ports.
>>
>> This can waste cpu time, even more with firewall enabled.
>> Also, if firewall is used with reject action, the src mac of RST
>> packet is the original unknown dest mac.
>> (This can block the server at Hetzner for example)
>>
>> So, we can disable learning && unicast_flood on tap|veth|fwln port interface.
>> Then mac address need to be add statically in bridge fdb.
> I'm a bit out of the loop of the with the whole bad hetzner network thingy, is this still
> relevant as I'd see if I can get it in finally..
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>

Hi,

Is it not enough to turn off unicast_flood on fwpr*?

If I have unicast_flood on fwln some scenarios does not work.

I have been running it a while now and it seems to solve all odd quirks
we've had with the networking on PVE.

Regards
Josef



  reply	other threads:[~2021-11-11 10:46 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-24  8:48 Alexandre Derumier
2021-09-24  8:48 ` [pve-devel] [PATCH pve-common 1/2] network: add support for disabling bridge learning on tap|veth|fwln ports Alexandre Derumier
2021-09-24  8:48 ` [pve-devel] [PATCH pve-common 2/2] Inotify: add bridge-disable-mac-learning option to bridges Alexandre Derumier
2021-11-11 10:40 ` [pve-devel] [PATCH pve-common 0/2] add disable bridge learning feature Thomas Lamprecht
2021-11-11 10:46   ` Josef Johansson [this message]
2021-11-11 18:38   ` DERUMIER, Alexandre
2022-03-16 16:33 ` [pve-devel] applied-series: " Thomas Lamprecht
2022-03-16 16:43   ` DERUMIER, Alexandre

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=196c3dc5-f926-55a9-661c-e7b9146c7b27@oderland.se \
    --to=josef@oderland.se \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal