OpenvSwitch 2.5 (with connection tracking) as replacement for iptables firewall model in the future

[mipsH]

Hello.

Since OpenvSwitch v.2.5 is out now, and it has support for connection tracking with linux kernel module (nf_conntrack) can we expect in the future that Proxmox VE will replace "old" network model and introduce a new one.

Situation is similar with OpenStack network model --> Video


This integration (openvSwitch 2.5 + nf_conntrack ) usage on linux kernel modules (at least)) is visible on Proxmox VE 4.2, using testing repo (pve-no-subscription) :


lsmod | grep openvswitch

openvswitch 94208 0
nf_defrag_ipv6 36864 1 openvswitch
nf_conntrack 106496 1 openvswitch
libcrc32c 16384 3 xfs,dm_persistent_data,openvswitch



BR,
Hrvoje.

 

[dietmar]

Thats interesting, but openflow does not work on a normal bridge, so that would be only the half solution.
Wolfgang is currently testing a nft based implementation, but there are still some problems with that.

But I would accept patches if someone wants to give that a try....

 

[mipsH]

Thats interesting, but openflow does not work on a normal bridge, so that would be only the half solution.
Wolfgang is currently testing a nft based implementation, but there are still some problems with that.

But I would accept patches if someone wants to give that a try....

As i understand, current network model of Proxmox VE is (as in picture - logical view):

And a new one (with OpenvSwitch 2.5.x, using nf_conntrack ) will be without the need of :

• using OpenvSwitch flows as possible Firewall solution since it is not build as Firewall (support only stateless matches, so solution will be "messy" for firewall functions - with very slow speed)
  
• and iptables as (old) firewall

But utilizing OpenvSwitch and nf_conntrack , as direct firewall (without OVS Flows which is not built to do a Firewall matches) and nf_conntrack does.

As it is described in Video (before):

So thats why OpenvSwitch and nf_conntrack finally .

Note : nf_conntrack is used by iptables also


And as i understand a new design will/could be: