tunproxy

[sliver-openvswitch.git] / INSTALL.userspace

diff --git a/INSTALL.userspace b/INSTALL.userspace
index 6e6fcd4..296f077 100644 (file)
--- a/INSTALL.userspace
+++ b/INSTALL.userspace
@@ -17,7 +17,7 @@ Building and Installing
 -----------------------
 
 The requirements and procedure for building, installing, and
 -----------------------
 
 The requirements and procedure for building, installing, and

-configuring Open vSwitch are the same as those given in INSTALL.Linux.
+configuring Open vSwitch are the same as those given in INSTALL.

 You may omit configuring, building, and installing the kernel module,
 and the related requirements.
 
 You may omit configuring, building, and installing the kernel module,
 and the related requirements.
 


@@ -31,6 +31,10 @@ The tun device must also exist as /dev/net/tun.  If it does not exist,
 then create /dev/net (if necessary) with "mkdir /dev/net", then create
 /dev/net/tun with "mknod /dev/net/tun c 10 200".
 
 then create /dev/net (if necessary) with "mkdir /dev/net", then create
 /dev/net/tun with "mknod /dev/net/tun c 10 200".
 

+On FreeBSD, the userspace switch additionally requires the kernel
+tap(4) driver to be available, either built into the kernel or loaded
+as a module.
+

 Using the Userspace Datapath with ovs-vswitchd
 ----------------------------------------------
 
 Using the Userspace Datapath with ovs-vswitchd
 ----------------------------------------------
 


@@ -47,6 +51,19 @@ ovs-vswitchd will create a TAP device as the bridge's local interface,
 named the same as the bridge, as well as for each configured internal
 interface.
 
 named the same as the bridge, as well as for each configured internal
 interface.
 

+Firewall Rules
+--------------
+
+On Linux, when a physical interface is in use by the userspace
+datapath, packets received on the interface still also pass into the
+kernel TCP/IP stack.  This can cause surprising and incorrect
+behavior.  You can use "iptables" to avoid this behavior, by using it
+to drop received packets.  For example, to drop packets received on
+eth0:
+
+    iptables -A INPUT -i eth0 -j DROP
+    iptables -A FORWARD -i eth0 -j DROP
+

 Bug Reporting
 -------------
 
 Bug Reporting
 -------------