From 06669325a770cbe8e63c3c50bdd92b2f5cdd08d6 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Tue, 20 Nov 2018 13:34:10 +0530 Subject: [PATCH] add --physdev-is-bridged flag when using physdev module for iptables rules created by weave-npc to prevent warning in kernel logs Fixes #3449 --- prog/weave-npc/main.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go index 12b5078f..e49e564c 100644 --- a/prog/weave-npc/main.go +++ b/prog/weave-npc/main.go @@ -128,7 +128,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error { // If the destination address is not any of the local pods, let it through if err := ipt.Append(npc.TableFilter, npc.MainChain, - "-m", "physdev", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil { + "-m", "physdev", "--physdev-is-bridged", "--physdev-out="+bridgePortName, "-j", "ACCEPT"); err != nil { return err } @@ -171,7 +171,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error { ruleSpecs := [][]string{ {"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"}, - {"-m", "physdev", "--physdev-in=" + bridgePortName, "-j", "RETURN"}, + {"-m", "physdev", "--physdev-is-bridged", "--physdev-in=" + bridgePortName, "-j", "RETURN"}, } if allowMcast { ruleSpecs = append(ruleSpecs, []string{"-d", "224.0.0.0/4", "-j", "RETURN"})