Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup some Flows with ovs-ofctl to block all unwanted incoming packets for a VM. The commands I use are:

ovs-ofctl add-flow xenbr0 "priority=65000, table=0, tcp, dl_src=*, nw_src=*, dl_dst=ba:90:11:a0:05:e4, nw_dst=192.168.0.18, tp_dst=22, tp_src=*, nw_proto=6, hard_timeout=60, actions=normal" 
ovs-ofctl add-flow xenbr0 "priority=65000, table=0, tcp, dl_src=*, nw_src=*, dl_dst=ba:90:11:a0:05:e4, nw_dst=192.168.0.18, tp_dst=80, tp_src=*, nw_proto=6, hard_timeout=60, actions=normal" 
ovs-ofctl add-flow xenbr0 "priority=64000, table=0, tcp, dl_src=ba:90:11:a0:05:e4, nw_src=192.168.0.18, dl_dst=*,nw_dst=*, tp_dst=*, tp_src=*, nw_proto=6, hard_timeout=60, actions=normal" 
ovs-ofctl add-flow xenbr0 "priority=60000, table=0, tcp, dl_src=*, nw_src=*, dl_dst=ba:90:11:a0:05:e4, nw_dst=192.168.0.18, tp_dst=*, nw_proto=6, hard_timeout=60, actions=drop"

These are working great - they allow incoming connections on port 22 and 80 and drop the rest. But there is one big problem: The drop flow/rule also disallows incoming SYN-ACKs. When I want to establish a connection from the VM to a remote host it won't work.

My reference for the commands: http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-ofctl.8

Now I need to know wether it is possible to:

only drop SYNs (and no SYN-ACKs) with ovs-ofctl? allow RELATED/ESTABLISHED connections like iptables? Thank you in advance.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.