From 6928929bc94f8f97c8ecd61dc9435759a0b2d0ab Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 18 May 2017 14:58:09 +0000 Subject: [PATCH] Install rules allowing outward traffic in npc mode --- net/bridge.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/net/bridge.go b/net/bridge.go index c7347ccf..f2772a45 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -453,14 +453,14 @@ func configureIPTables(config *BridgeConfig) error { if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil { return err } - // Forward from weave to the rest of the world - if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "!", "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil { - return err - } - // and allow replies back - if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil { - return err - } + } + // Forward from weave to the rest of the world + if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "!", "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil { + return err + } + // and allow replies back + if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil { + return err } // create a chain for masquerading