Add rule to allow multicast at top level

prog/weave-npc/main.go

@@ -27,6 +27,7 @@ var (
 	version     = "unreleased"
 	metricsAddr string
 	logLevel    string
+	allowMcast  bool
 )
 
 func handleError(err error) { common.CheckFatal(err) }
@@ -58,6 +59,13 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
+	if allowMcast {
+		if err := ipt.Append(npc.TableFilter, npc.MainChain,
+			"-d", "224.0.0.0/4", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
 		"-m", "state", "--state", "NEW", "-j", string(npc.DefaultChain)); err != nil {
 		return err
@@ -166,6 +174,7 @@ func main() {
 
 	rootCmd.PersistentFlags().StringVar(&metricsAddr, "metrics-addr", ":6781", "metrics server bind address")
 	rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)")
+	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
 
 	handleError(rootCmd.Execute())
 }