Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup some Flows with ovs-ofctl to block all unwanted incoming packets for a VM. The commands I use are:

ovs-ofctl add-flow xenbr0 "priority=65000, table=0, tcp, dl_src=*, nw_src=*, dl_dst=ba:90:11:a0:05:e4, nw_dst=192.168.0.18, tp_dst=22, tp_src=*, nw_proto=6, hard_timeout=60, actions=normal" 
ovs-ofctl add-flow xenbr0 "priority=65000, table=0, tcp, dl_src=*, nw_src=*, dl_dst=ba:90:11:a0:05:e4, nw_dst=192.168.0.18, tp_dst=80, tp_src=*, nw_proto=6, hard_timeout=60, actions=normal" 
ovs-ofctl add-flow xenbr0 "priority=64000, table=0, tcp, dl_src=ba:90:11:a0:05:e4, nw_src=192.168.0.18, dl_dst=*,nw_dst=*, tp_dst=*, tp_src=*, nw_proto=6, hard_timeout=60, actions=normal" 
ovs-ofctl add-flow xenbr0 "priority=60000, table=0, tcp, dl_src=*, nw_src=*, dl_dst=ba:90:11:a0:05:e4, nw_dst=192.168.0.18, tp_dst=*, nw_proto=6, hard_timeout=60, actions=drop"

These are working great - they allow incoming connections on port 22 and 80 and drop the rest. But there is one big problem: The drop flow/rule also disallows incoming SYN-ACKs. When I want to establish a connection from the VM to a remote host it won't work.

My reference for the commands: http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-ofctl.8

Now I need to know wether it is possible to:

only drop SYNs (and no SYN-ACKs) with ovs-ofctl? allow RELATED/ESTABLISHED connections like iptables? Thank you in advance.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.