libvirt/examples/xml/nwfilter/no-arp-mac-spoofing.xml

<filter name='no-arp-mac-spoofing' chain='arp-mac' priority='-520'>
   <rule action='return' direction='out' priority='350' >
      <arp match='yes' arpsrcmacaddr='$MAC'/>
   </rule>
   <!-- drop everything else -->
   <rule action='drop' direction='out' priority='1000' />
</filter>
Update of filters to handle multiple IP addresses With fragments borrowed from David Steven's previous submission and some further modifications: A set of modifications to filters to handle multiple IP addresses (and MAC addresses) per interface. Also: - enable DHCP traffic from VM to any DHCP server - will require an update to a libvirt-tck data file Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> 2011-12-02 01:34:36 +00:00			`<filter name='no-arp-mac-spoofing' chain='arp-mac' priority='-520'>`
			`<rule action='return' direction='out' priority='350' >`
			`<arp match='yes' arpsrcmacaddr='$MAC'/>`
			`</rule>`
			`<!-- drop everything else -->`
			`<rule action='drop' direction='out' priority='1000' />`
			`</filter>`