From 23e1e1db1f047ff95d18fca0e103ffbbfc2057a7 Mon Sep 17 00:00:00 2001
From: Marek Marczykowski <marmarek@invisiblethingslab.com>
Date: Sat, 3 Mar 2012 01:30:04 +0100
Subject: [PATCH] vm/network: place anti-spoof rules in 'raw' table

---
 network/vif-route-qubes | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/network/vif-route-qubes b/network/vif-route-qubes
index d6183e2..385b665 100755
--- a/network/vif-route-qubes
+++ b/network/vif-route-qubes
@@ -30,13 +30,13 @@ case "$command" in
 		ifconfig ${vif} up
 		echo 1 >/proc/sys/net/ipv4/conf/${vif}/proxy_arp
 		ipcmd='replace'
-		iptables_cmd='-I FORWARD 1'
+		iptables_cmd='-I PREROUTING 1'
 		cmdprefix=''
 		;;
 	offline)
 		do_without_error ifdown ${vif}
 		ipcmd='del'
-		iptables_cmd='-D FORWARD'
+		iptables_cmd='-D PREROUTING'
 		cmdprefix='do_without_error'
 		;;
 esac
@@ -47,7 +47,7 @@ if [ "${ip}" ] ; then
 	for addr in ${ip} ; do
 		${cmdprefix} ip route ${ipcmd} ${addr} dev ${vif} || true
 	done
-		echo ${cmdprefix} iptables $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
+		echo ${cmdprefix} iptables -t raw $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
 		${cmdprefix} iptables $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
 fi