Skip to content

Commit 7919901

Browse files
zhangzujianzhangzujian
authored
Merge pull request #1171 from fanriming/fix-nat
fix nat rule
2 parents bd42f2c + e713bdf commit 7919901

File tree

2 files changed

+18
-22
lines changed

2 files changed

+18
-22
lines changed

‎dist/images/uninstall.sh

+2-6
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ iptables -t nat -D POSTROUTING -m set ! --match-set ovn40subnets src -m set ! --
2525
iptables -t nat -D POSTROUTING -m set ! --match-set ovn40subnets src -m set ! --match-set ovn40other-node src -m set --match-set ovn40subnets-nat dst -j RETURN
2626
iptables -t nat -D POSTROUTING -m set --match-set ovn40subnets-nat src -m set ! --match-set ovn40subnets dst -j MASQUERADE
2727
iptables -t nat -D POSTROUTING -m set --match-set ovn40local-pod-ip-nat src -m set ! --match-set ovn40subnets dst -j MASQUERADE
28-
iptables -t nat -D POSTROUTING -m mark --mark 0x40000/0x40000 -j MASQUERADE
29-
iptables -t mangle -D PREROUTING -i ovn0 -m set --match-set ovn40subnets src -m set --match-set ovn40services dst -j MARK --set-xmark 0x40000/0x40000
3028
iptables -t filter -D INPUT -m set --match-set ovn40subnets dst -j ACCEPT
3129
iptables -t filter -D INPUT -m set --match-set ovn40subnets src -j ACCEPT
3230
iptables -t filter -D INPUT -m set --match-set ovn40services dst -j ACCEPT
@@ -38,7 +36,7 @@ iptables -t filter -D FORWARD -m set --match-set ovn40services src -j ACCEPT
3836
iptables -t filter -D OUTPUT -p udp -m udp --dport 6081 -j MARK --set-xmark 0x0
3937

4038
if [ -n "$nodeIPv4" ]; then
41-
iptables -t nat -D POSTROUTING ! -s "$nodeIPv4" -m set --match-set ovn40subnets dst -j MASQUERADE
39+
iptables -t nat -D POSTROUTING ! -s "$nodeIPv4" -m set ! --match-set ovn40subnets src -m set --match-set ovn40subnets dst -j MASQUERADE
4240
fi
4341

4442
sleep 1
@@ -53,8 +51,6 @@ ip6tables -t nat -D POSTROUTING -m set ! --match-set ovn60subnets src -m set ! -
5351
ip6tables -t nat -D POSTROUTING -m set ! --match-set ovn60subnets src -m set ! --match-set ovn60other-node src -m set --match-set ovn60subnets-nat dst -j RETURN
5452
ip6tables -t nat -D POSTROUTING -m set --match-set ovn60subnets-nat src -m set ! --match-set ovn60subnets dst -j MASQUERADE
5553
ip6tables -t nat -D POSTROUTING -m set --match-set ovn60local-pod-ip-nat src -m set ! --match-set ovn60subnets dst -j MASQUERADE
56-
ip6tables -t nat -D POSTROUTING -m mark --mark 0x40000/0x40000 -j MASQUERADE
57-
ip6tables -t mangle -D PREROUTING -i ovn0 -m set --match-set ovn60subnets src -m set --match-set ovn60services dst -j MARK --set-xmark 0x40000/0x40000
5854
ip6tables -t filter -D INPUT -m set --match-set ovn60subnets dst -j ACCEPT
5955
ip6tables -t filter -D INPUT -m set --match-set ovn60subnets src -j ACCEPT
6056
ip6tables -t filter -D INPUT -m set --match-set ovn60services dst -j ACCEPT
@@ -66,7 +62,7 @@ ip6tables -t filter -D FORWARD -m set --match-set ovn60services src -j ACCEPT
6662
ip6tables -t filter -D OUTPUT -p udp -m udp --dport 6081 -j MARK --set-xmark 0x0
6763

6864
if [ -n "$nodeIPv6" ]; then
69-
ip6tables -t nat -D POSTROUTING ! -s "$nodeIPv6" -m set --match-set ovn60subnets dst -j MASQUERADE
65+
ip6tables -t nat -D POSTROUTING ! -s "$nodeIPv6" -m set ! --match-set ovn60subnets src -m set --match-set ovn60subnets dst -j MASQUERADE
7066
fi
7167

7268
sleep 1

‎pkg/daemon/gateway.go

+16-16
Original file line numberDiff line numberDiff line change
@@ -420,19 +420,22 @@ func (c *Controller) setIptables() error {
420420
klog.V(3).Infof("centralized subnets nat ips %v", subnetNatips)
421421

422422
var (
423+
v4AbandonedRules = []util.IPTableRule{
424+
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m mark --mark 0x40000/0x40000 -j MASQUERADE`)},
425+
{Table: "mangle", Chain: "PREROUTING", Rule: strings.Fields(`-i ovn0 -m set --match-set ovn40subnets src -m set --match-set ovn40services dst -j MARK --set-xmark 0x40000/0x40000`)},
426+
}
427+
v6AbandonedRules = []util.IPTableRule{
428+
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m mark --mark 0x40000/0x40000 -j MASQUERADE`)},
429+
{Table: "mangle", Chain: "PREROUTING", Rule: strings.Fields(`-i ovn0 -m set --match-set ovn60subnets src -m set --match-set ovn60services dst -j MARK --set-xmark 0x40000/0x40000`)},
430+
}
431+
423432
v4Rules = []util.IPTableRule{
424433
// do not nat route traffic
425434
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m set ! --match-set ovn40subnets src -m set ! --match-set ovn40other-node src -m set --match-set ovn40local-pod-ip-nat dst -j RETURN`)},
426435
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m set ! --match-set ovn40subnets src -m set ! --match-set ovn40other-node src -m set --match-set ovn40subnets-nat dst -j RETURN`)},
427436
// nat outgoing
428437
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m set --match-set ovn40subnets-nat src -m set ! --match-set ovn40subnets dst -j MASQUERADE`)},
429438
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m set --match-set ovn40local-pod-ip-nat src -m set ! --match-set ovn40subnets dst -j MASQUERADE`)},
430-
// external traffic to overlay pod or to service
431-
// {Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`! -s %s -m set --match-set ovn40subnets dst -j MASQUERADE`, nodeIPv4))},
432-
// masq traffic from overlay pod to service
433-
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m mark --mark 0x40000/0x40000 -j MASQUERADE`)},
434-
// mark traffic from overlay pod to service
435-
{Table: "mangle", Chain: "PREROUTING", Rule: strings.Fields(`-i ovn0 -m set --match-set ovn40subnets src -m set --match-set ovn40services dst -j MARK --set-xmark 0x40000/0x40000`)},
436439
// Input Accept
437440
{Table: "filter", Chain: "INPUT", Rule: strings.Fields(`-m set --match-set ovn40subnets src -j ACCEPT`)},
438441
{Table: "filter", Chain: "INPUT", Rule: strings.Fields(`-m set --match-set ovn40subnets dst -j ACCEPT`)},
@@ -453,12 +456,6 @@ func (c *Controller) setIptables() error {
453456
// nat outgoing
454457
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m set --match-set ovn60subnets-nat src -m set ! --match-set ovn60subnets dst -j MASQUERADE`)},
455458
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m set --match-set ovn60local-pod-ip-nat src -m set ! --match-set ovn60subnets dst -j MASQUERADE`)},
456-
// external traffic to overlay pod or to service
457-
// {Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`! -s %s -m set --match-set ovn60subnets dst -j MASQUERADE`, nodeIPv6))},
458-
// masq traffic from overlay pod to service
459-
{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(`-m mark --mark 0x40000/0x40000 -j MASQUERADE`)},
460-
// mark traffic from overlay pod to service
461-
{Table: "mangle", Chain: "PREROUTING", Rule: strings.Fields(`-i ovn0 -m set --match-set ovn60subnets src -m set --match-set ovn60services dst -j MARK --set-xmark 0x40000/0x40000`)},
462459
// Input Accept
463460
{Table: "filter", Chain: "INPUT", Rule: strings.Fields(`-m set --match-set ovn60subnets src -j ACCEPT`)},
464461
{Table: "filter", Chain: "INPUT", Rule: strings.Fields(`-m set --match-set ovn60subnets dst -j ACCEPT`)},
@@ -494,19 +491,22 @@ func (c *Controller) setIptables() error {
494491
var matchset string
495492
var abandonedRules, iptablesRules []util.IPTableRule
496493
if protocol == kubeovnv1.ProtocolIPv4 {
497-
iptablesRules = v4Rules
494+
iptablesRules, abandonedRules = v4Rules, v4AbandonedRules
498495
matchset = "ovn40subnets"
499496
} else {
500-
iptablesRules = v6Rules
497+
iptablesRules, abandonedRules = v6Rules, v6AbandonedRules
501498
matchset = "ovn60subnets"
502499
}
503500

504501
if nodeIP := nodeIPs[protocol]; nodeIP != "" {
505-
abandonedRules = append(abandonedRules, util.IPTableRule{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`-o ovn0 ! -s %s -m mark --mark 0x4000/0x4000 -j MASQUERADE`, nodeIP))})
502+
abandonedRules = append(abandonedRules,
503+
util.IPTableRule{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`-o ovn0 ! -s %s -m mark --mark 0x4000/0x4000 -j MASQUERADE`, nodeIP))},
504+
util.IPTableRule{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`! -s %s -m set --match-set %s dst -j MASQUERADE`, nodeIP, matchset))},
505+
)
506506

507507
rules := make([]util.IPTableRule, len(iptablesRules)+1)
508508
copy(rules[:4], iptablesRules[:4])
509-
rules[4] = util.IPTableRule{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`! -s %s -m set --match-set %s dst -j MASQUERADE`, nodeIP, matchset))}
509+
rules[4] = util.IPTableRule{Table: "nat", Chain: "POSTROUTING", Rule: strings.Fields(fmt.Sprintf(`! -s %s -m set ! --match-set %s src -m set --match-set %s dst -j MASQUERADE`, nodeIP, matchset, matchset))}
510510
copy(rules[5:], iptablesRules[4:])
511511
iptablesRules = rules
512512
}

0 commit comments

Comments
 (0)