Hello @jorel,
I am working on extending it to handle https://github.com/OpenNebula/one/issues/3079 but haven’t enough time to work on it. The refactoring is to define the mac filtering in an ebtables sub-chain with default policy drop that allow all MACs(IP and “alias” ones). The VNM filter should be extended too. I think the entire MAC spoofing filters should be redesigned because they could be handled entirely with ebtables. Currently they are implemented in the ONE iptables rules and only the ARP spoofing is implemented with ebtables…
Cheers,
Anton