From 0ad2001ab457058545e53f0868e31ee33f50ac0a Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynas@weave.works>
Date: Sat, 21 Jul 2018 16:10:50 +0200
Subject: [PATCH] npc: ACCEPT already established connections in egress chain

It's safe to accept such connections as they will be accepted
in the ingress chain anyway.
---
 prog/weave-npc/main.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index 4c6868f7..26fb79db 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -158,7 +158,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 
 	// Egress rules:
 	//
-	// -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
+	// -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j ACCEPT
 	// -A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
 	// -A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
 	// -A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
@@ -179,7 +179,7 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	// check both chains).
 
 	ruleSpecs := [][]string{
-		{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"},
+		{"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"},
 		{"-m", "state", "--state", "NEW", "-m", "set", "!", "--match-set", npc.LocalIpset, "src", "-j", "RETURN"},
 	}
 	if allowMcast {