From a2d07c85dacb74f7529b08d6875ac5f3956aa79e Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Tue, 29 May 2018 14:58:48 +0200 Subject: [PATCH] npc: Remove WEAVE-NPC-EGRESS* chains upon "weave reset" Also, fix removal of rule which steers traffic for ingress processing. --- weave | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/weave b/weave index 599afb94..e5bb8b7d 100755 --- a/weave +++ b/weave @@ -492,14 +492,20 @@ destroy_bridge() { run_iptables -t filter -D FORWARD -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true run_iptables -F WEAVE-NPC >/dev/null 2>&1 || true - run_iptables -t filter -D FORWARD -o $BRIDGE -j WEAVE-NPC 2>/dev/null || true + run_iptables -t filter -D FORWARD -o $BRIDGE -m comment --comment "NOTE: this must go before '-j KUBE-FORWARD'" -j WEAVE-NPC 2>/dev/null || true run_iptables -t filter -D FORWARD -o $BRIDGE -m state --state NEW -j NFLOG --nflog-group 86 2>/dev/null || true run_iptables -t filter -D FORWARD -o $BRIDGE -j DROP 2>/dev/null || true run_iptables -X WEAVE-NPC >/dev/null 2>&1 || true run_iptables -F WEAVE-NPC-EGRESS >/dev/null 2>&1 || true - run_iptables -t filter -D FORWARD -o $BRIDGE -j WEAVE-NPC-EGRESS 2>/dev/null || true + run_iptables -t filter -D FORWARD -i $BRIDGE -m comment --comment "NOTE: this must go before '-j KUBE-FORWARD'" -j WEAVE-NPC-EGRESS 2>/dev/null || true run_iptables -t filter -D INPUT -i $BRIDGE -j WEAVE-NPC-EGRESS 2>/dev/null || true run_iptables -X WEAVE-NPC-EGRESS >/dev/null 2>&1 || true + run_iptables -F WEAVE-NPC-EGRESS-DEFAULT >/dev/null 2>&1 || true + run_iptables -X WEAVE-NPC-EGRESS-DEFAULT >/dev/null 2>&1 || true + run_iptables -F WEAVE-NPC-EGRESS-CUSTOM >/dev/null 2>&1 || true + run_iptables -X WEAVE-NPC-EGRESS-CUSTOM >/dev/null 2>&1 || true + run_iptables -F WEAVE-NPC-EGRESS-ACCEPT >/dev/null 2>&1 || true + run_iptables -X WEAVE-NPC-EGRESS-ACCEPT >/dev/null 2>&1 || true run_iptables -F WEAVE-EXPOSE >/dev/null 2>&1 || true run_iptables -t filter -D FORWARD -o $BRIDGE -j WEAVE-EXPOSE 2>/dev/null || true