From d8f1a044678f598066cd75ffa520b0bfdbff638a Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Mon, 4 May 2015 09:59:58 +0100 Subject: [PATCH] only NAT when crossing between subnets otherwise we can end up NATing traffic inside a subnet, placing it outside the subnet and thus breaking connectivity. --- weave | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/weave b/weave index 39b17fb7..786c62ac 100755 --- a/weave +++ b/weave @@ -817,8 +817,8 @@ case "$COMMAND" in then ip addr add dev $BRIDGE $CIDR arp_update $BRIDGE $CIDR - add_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE - add_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE + add_iptables_rule nat WEAVE -d $CIDR ! -s $CIDR -j MASQUERADE + add_iptables_rule nat WEAVE -s $CIDR ! -d $CIDR -j MASQUERADE if [ "$FQDN" ]; then http_call $DNS_CONTAINER_NAME $DNS_HTTP_PORT PUT /name/weave:expose/${CIDR%/*} --data-urlencode "fqdn=$FQDN" 2>/dev/null || true fi @@ -834,8 +834,8 @@ case "$COMMAND" in if ip addr show dev $BRIDGE | grep -qF $CIDR then ip addr del dev $BRIDGE $CIDR - delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE - delete_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE + delete_iptables_rule nat WEAVE -d $CIDR ! -s $CIDR -j MASQUERADE + delete_iptables_rule nat WEAVE -s $CIDR ! -d $CIDR -j MASQUERADE http_call $DNS_CONTAINER_NAME $DNS_HTTP_PORT DELETE /name/weave:expose/${CIDR%/*} 2>/dev/null || true fi done