Change the default ip forward policy to DROP #2409
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: karampok The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test all |
1 similar comment
|
/test all |
karampok
force-pushed
the
iptables-drop-forward-policy
branch
from
3eb16d8
to
b5d6be9
Compare
|
/retest |
When an OCP node has many interfaces, this node can act as router because the current default forward is ACCEPT. The current solution which is blocking ip forwarding only in sysctl level `net.ipv4.ip_forward=0` that is inherited to all interfaces is not working because it breaks the external LB (metallb) case and therefore forwarding on those interface must be on. The IP_FORWARD_MODE to Global is an opt-out option if for any reason there is a use case that accidentally works due to previous ACCEPT policy. Signed-off-by: karampok <karampok@gmail.com>
karampok
force-pushed
the
iptables-drop-forward-policy
branch
from
b5d6be9
to
e3cb8d5
Compare
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@trozet this PR should be the minimum changes, CI seems to fails for different reason. Thanks for the feedback |
|
@karampok: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
|
why the hold @karampok ? |
|
There is the PR that actually does the same ovn-org/ovn-kubernetes#4376, if this PR goes in do we still want to add this? @trozet the on-hold is to avoid just merge without a CI run, and not sure if we need to followup something as part of documentation. |
When an OCP node has many interfaces, this node can act as router because the current default forward is ACCEPT. The current solution which is blocking ip forwarding only in sysctl level
net.ipv4.ip_forward=0that is inherited to all interfaces is not working because it breaks the external LB (metallb) case and therefore forwarding on those interface must be on.The IP_FORWARD_MODE to Global is an opt-out option if for any reason there is a use case that accidentally works due to previous ACCEPT policy.
https://issues.redhat.com/browse/OCPBUGS-3176