From 9a5514ffe03cc06e7c709c361bf69145d435254d Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Sat, 20 Jan 2018 12:57:11 +0100 Subject: [PATCH] Add comment about the FORWARD rule order Should help debugging. --- net/bridge.go | 4 +++- test/191_create_bridge_2_test.sh | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/bridge.go b/net/bridge.go index 403d43ed..21719aa2 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -449,7 +449,9 @@ func configureIPTables(config *BridgeConfig) error { // If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail fwdRules = append(fwdRules, [][]string{ - {"-o", config.WeaveBridgeName, "-j", "WEAVE-NPC"}, + {"-o", config.WeaveBridgeName, + "-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'", + "-j", "WEAVE-NPC"}, {"-o", config.WeaveBridgeName, "-m", "state", "--state", "NEW", "-j", "NFLOG", "--nflog-group", "86"}, {"-o", config.WeaveBridgeName, "-j", "DROP"}, }...) diff --git a/test/191_create_bridge_2_test.sh b/test/191_create_bridge_2_test.sh index fa26c780..abca8a9b 100755 --- a/test/191_create_bridge_2_test.sh +++ b/test/191_create_bridge_2_test.sh @@ -48,7 +48,7 @@ IPT_BEFORE=$(mktemp) IPT_AFTER=$(mktemp) run_on $HOST1 "sudo iptables-save | grep -i weave | grep -v '\[.*:.*\]' > $IPT_BEFORE" -run_on $HOST1 sudo iptables -t filter -D FORWARD -o weave -j WEAVE-NPC +run_on $HOST1 "sudo iptables -t filter -D FORWARD -o weave -m comment --comment \"NOTE: this must go before '-j KUBE-FORWARD'\" -j WEAVE-NPC" run_on $HOST1 sudo iptables -t nat -D POSTROUTING -j WEAVE kill_weaver # should re-create the bridge and iptables friends