reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add --physdev-is-bridged flag when using physdev module for iptables

Browse Source 
rules created by weave-npc to prevent warning in kernel logs

Fixes #3449
This commit is contained in:
Murali Reddy committed 2018-11-20 13:34:10 +05:30
1 parent 6e3f8a1c7a
commit 06669325a7
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
prog/weave-npc/main.go
+2 -2
View File
@@ -128,7 +128,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
// If the destination address is not any of the local pods, let it through
if err := ipt.Append(npc.TableFilter, npc.MainChain,
"-m", "physdev", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
"-m", "physdev", "--physdev-is-bridged", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil {
return err
}
@@ -171,7 +171,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
ruleSpecs := [][]string{
{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
{"-m", "physdev", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
{"-m", "physdev", "--physdev-is-bridged", "--physdev-in=" + bridgePortName, "-j", "RETURN"},
}
if allowMcast {
ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})