Re: [PATCH v2 nf] netfilter: disable br_netfilter in user namespaces

Florian Westphal <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <[email protected]> 
Nikolay Aleksandrov <[email protected]> wrote:
> The patch looks good, thanks!
> 2 minor nits:
> BROPT_NF_CALL_IPTABLES is per bridge, not per port. Also please update the
> Netfilter section of Documentation/networking/bridge.rst that it won't work
> in non-init ns and is scheduled for removal.

This sound good to you?

 The bridge netfilter module is a legacy feature that allows to filter bridged
-packets with iptables and ip6tables. Its use is discouraged. Users should
-consider using nftables for packet filtering.
+packets with iptables and ip6tables. This feature is scheduled for removal and
+not available in user namespaces. Consider using nftables for packet filtering
+instead.

Thanks!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.