make filter table forward chain default accept

kubeovn · Apr 12, 2019 · ca21c6c · ca21c6c
1 parent 46e7b5b
commit ca21c6c
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 9 deletions.
diff --git a/pkg/daemon/gateway.go b/pkg/daemon/gateway.go
@@ -15,7 +15,24 @@ const (
 	SubnetSet   = "subnets"
 	LocalPodSet = "local-pod-ip-nat"
 	IPSetPrefix = "ovn"
-	NATRule     = "-m set --match-set ovn40local-pod-ip-nat src -m set ! --match-set ovn40subnets dst -j MASQUERADE"
+)
+
+var (
+	natRule = util.IPTableRule{
+		Table: "nat",
+		Chain: "POSTROUTING",
+		Rule:  strings.Split("-m set --match-set ovn40local-pod-ip-nat src -m set ! --match-set ovn40subnets dst -j MASQUERADE", " "),
+	}
+	forwardAcceptRule1 = util.IPTableRule{
+		Table: "filter",
+		Chain: "FORWARD",
+		Rule:  strings.Split("-i ovn0 -j ACCEPT", " "),
+	}
+	forwardAcceptRule2 = util.IPTableRule{
+		Table: "filter",
+		Chain: "FORWARD",
+		Rule:  strings.Split(`-o ovn0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`, " "),
+	}
 )
 
 func (c *Controller) runGateway(stopCh <-chan struct{}) error {
@@ -42,17 +59,20 @@ func (c *Controller) runGateway(stopCh <-chan struct{}) error {
 	}, localPodIPs)
 	c.ipSetsMgr.ApplyUpdates()
 
-	exist, err := c.iptablesMgr.Exists("nat", "POSTROUTING", strings.Split(NATRule, " ")...)
-	if err != nil {
-		klog.Errorf("check iptable rule failed, %+v", err)
-		return err
-	}
-	if !exist {
-		err = c.iptablesMgr.AppendUnique("nat", "POSTROUTING", strings.Split(NATRule, " ")...)
+	for _, iptRule := range []util.IPTableRule{forwardAcceptRule1, forwardAcceptRule2, natRule} {
+		exists, err := c.iptablesMgr.Exists(iptRule.Table, iptRule.Chain, iptRule.Rule...)
 		if err != nil {
-			klog.Errorf("append iptable rule failed, %+v", err)
+			klog.Errorf("check iptable rule exist failed, %+v", err)
 			return err
 		}
+		if !exists {
+			err := c.iptablesMgr.Insert(iptRule.Table, iptRule.Chain, 1, iptRule.Rule...)
+			if err != nil {
+				klog.Errorf("insert iptable rule exist failed, %+v", err)
+				return err
+			}
+		}
+
 	}
 
 	ticker := time.NewTicker(3 * time.Second)

diff --git a/pkg/util/iptables.go b/pkg/util/iptables.go
@@ -0,0 +1,7 @@
+package util
+
+type IPTableRule struct {
+	Table string
+	Chain string
+	Rule  []string
+}