New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

need special 'mangle' table rule for DHCP in LXC containers #184

Closed
tycho opened this Issue Jan 16, 2017 · 12 comments

Comments

Projects
None yet
4 participants
@tycho

tycho commented Jan 16, 2017

I recently moved my custom iptables config into a FireHOL config, but there's one rule that I can't seem to find a way to replace:

iptables -t mangle -A POSTROUTING -o br0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill

This is a necessary rule for DHCP to work properly for LXC containers that are running on the same physical machine as the DHCP server.

Is there any way for FireHOL to support this kind of rule? If not, could support be added?

@ktsaou

This comment has been minimized.

Show comment
Hide comment
@ktsaou

ktsaou Jan 16, 2017

Member

hi.

Add it exactly as-shown on your comment to your firehol.conf (do not add /sbin/ in front of it).

The iptables command in firehol.conf is a firehol command. It knows how to keep the rule in the generated firewall.

(this is strange though - my lxc does not need it).

Member

ktsaou commented Jan 16, 2017

hi.

Add it exactly as-shown on your comment to your firehol.conf (do not add /sbin/ in front of it).

The iptables command in firehol.conf is a firehol command. It knows how to keep the rule in the generated firewall.

(this is strange though - my lxc does not need it).

@tycho

This comment has been minimized.

Show comment
Hide comment
@tycho

tycho Jan 16, 2017

Hi @ktsaou, does your LXC setup run on the same machine as the DHCP server? If not, that's probably why you don't need it.

Also, just tried as you suggested, and that worked perfectly. Thanks! 👍

tycho commented Jan 16, 2017

Hi @ktsaou, does your LXC setup run on the same machine as the DHCP server? If not, that's probably why you don't need it.

Also, just tried as you suggested, and that worked perfectly. Thanks! 👍

@tycho tycho closed this Jan 16, 2017

@ktsaou

This comment has been minimized.

Show comment
Hide comment
@ktsaou

ktsaou Jan 16, 2017

Member

does your LXC setup run on the same machine as the DHCP server

yes it does... check this: http://azure-west-eu.my-netdata.io/ - the lxc alpine container there works line that.

Member

ktsaou commented Jan 16, 2017

does your LXC setup run on the same machine as the DHCP server

yes it does... check this: http://azure-west-eu.my-netdata.io/ - the lxc alpine container there works line that.

@tycho

This comment has been minimized.

Show comment
Hide comment
@tycho

tycho Jan 16, 2017

@ktsaou May also have to do with what DHCP client it's using. does your LXC container use dhcpcd or dhclient, or something else? In any case, mine were using dhclient, and tried to DHCP but would drop the responses without valid checksums, and they'd never get IP addresses. 😞

tycho commented Jan 16, 2017

@ktsaou May also have to do with what DHCP client it's using. does your LXC container use dhcpcd or dhclient, or something else? In any case, mine were using dhclient, and tried to DHCP but would drop the responses without valid checksums, and they'd never get IP addresses. 😞

@Doccos

This comment has been minimized.

Show comment
Hide comment
@Doccos

Doccos Jul 11, 2017

I had the same Problem... i added the line in die firehol.conf
iptables -A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill

when i try "firehol try" i get the error:
`ERROR : # 1.
WHAT : A runtime command failed to execute (returned error CANNOT APPLY IN FAST MODE).
SOURCE : FIN
COMMAND : /sbin/iptables-restore </var/run/firehol/firehol-KUfgwbcfkr/firehol-out.sh.fast
OUTPUT :

iptables-restore v1.4.21: The -t option (seen in line 22) cannot be used in iptables-restore.

Error occurred at line: 22
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Offending line:
-A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill
`

Doccos commented Jul 11, 2017

I had the same Problem... i added the line in die firehol.conf
iptables -A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill

when i try "firehol try" i get the error:
`ERROR : # 1.
WHAT : A runtime command failed to execute (returned error CANNOT APPLY IN FAST MODE).
SOURCE : FIN
COMMAND : /sbin/iptables-restore </var/run/firehol/firehol-KUfgwbcfkr/firehol-out.sh.fast
OUTPUT :

iptables-restore v1.4.21: The -t option (seen in line 22) cannot be used in iptables-restore.

Error occurred at line: 22
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Offending line:
-A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill
`

@ktsaou

This comment has been minimized.

Show comment
Hide comment
@ktsaou

ktsaou Jul 11, 2017

Member

try this:

iptables -t mangle -A POSTROUTING -p udp --dport 68 -j CHECKSUM --checksum-fill

It needs the table first.

Member

ktsaou commented Jul 11, 2017

try this:

iptables -t mangle -A POSTROUTING -p udp --dport 68 -j CHECKSUM --checksum-fill

It needs the table first.

@philwhineray

This comment has been minimized.

Show comment
Hide comment
@philwhineray

philwhineray Jul 11, 2017

Member

Looks like you need to disable fast activation. Set FIREHOL_FAST_ACTIVATION=0 in /etc/firehol/firehol-defaults.conf.

@ktsaou it looks like we will need to handle the -t ourselves with iptables commands in fast activation mode, to make sure the rules are appended to a specific table.

Member

philwhineray commented Jul 11, 2017

Looks like you need to disable fast activation. Set FIREHOL_FAST_ACTIVATION=0 in /etc/firehol/firehol-defaults.conf.

@ktsaou it looks like we will need to handle the -t ourselves with iptables commands in fast activation mode, to make sure the rules are appended to a specific table.

@ktsaou

This comment has been minimized.

Show comment
Hide comment
@ktsaou

ktsaou Jul 11, 2017

Member

@ktsaou it looks like we will need to handle the -t ourselves with iptables commands in fast activation mode, to make sure the rules are appended to a specific table.

We do, but it has to be the first parameter to iptables.

Member

ktsaou commented Jul 11, 2017

@ktsaou it looks like we will need to handle the -t ourselves with iptables commands in fast activation mode, to make sure the rules are appended to a specific table.

We do, but it has to be the first parameter to iptables.

@philwhineray

This comment has been minimized.

Show comment
Hide comment
@philwhineray

philwhineray Jul 11, 2017

Member

Oh, OK I see it is, provided it comes first.

Member

philwhineray commented Jul 11, 2017

Oh, OK I see it is, provided it comes first.

@philwhineray

This comment has been minimized.

Show comment
Hide comment
@philwhineray

philwhineray Jul 11, 2017

Member

I'll make a note in the docs this week. I need to update mark and connmark too. They are now just shortcuts for two pre-specified custommarks, right?

Member

philwhineray commented Jul 11, 2017

I'll make a note in the docs this week. I need to update mark and connmark too. They are now just shortcuts for two pre-specified custommarks, right?

@ktsaou

This comment has been minimized.

Show comment
Hide comment
@ktsaou

ktsaou Jul 11, 2017

Member

They are now just shortcuts for two pre-specified custommarks, right?

I think yes. All marks are now bit-mapped.

Member

ktsaou commented Jul 11, 2017

They are now just shortcuts for two pre-specified custommarks, right?

I think yes. All marks are now bit-mapped.

@Doccos

This comment has been minimized.

Show comment
Hide comment
@Doccos

Doccos Jul 11, 2017

iptables -t mangle -A POSTROUTING -p udp --dport 68 -j CHECKSUM --checksum-fill works

thanks 👍

Doccos commented Jul 11, 2017

iptables -t mangle -A POSTROUTING -p udp --dport 68 -j CHECKSUM --checksum-fill works

thanks 👍

philwhineray added a commit that referenced this issue Jul 11, 2017

philwhineray added a commit that referenced this issue Aug 20, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment