pkg/mesh/routes.go: add flag for generic ACCEPT in FORWARD chain#244
pkg/mesh/routes.go: add flag for generic ACCEPT in FORWARD chain#244leonnicolas merged 3 commits intomainfrom
Conversation
Some linux distros or docker will set the default policy in the FORWARD chain in the filter table to DROP. With the new ip-tables-forward-rules flag a generic ACCEPT for all packages going from and to the pod subnet is added to the FORWARD chain. Signed-off-by: leonnicolas <leonloechner@gmx.de>
Co-authored-by: Lucas Servén Marín <lserven@gmail.com>
squat
left a comment
squat
left a comment
There was a problem hiding this comment.
Looks good to me. This implements exactly the same semantics as the identically named flag in Flannel (https://github.com/flannel-io/flannel/blob/master/main.go#L144).
Do you think we want a warning in the flag description?
That was my plan, but I imagined an extra dash ^^
Something like: warning this may break firewalls with a deny all policy? |
Yes something like that would be great. |
2 participants
Some linux distros or docker will set the default policy in the FORWARD
chain in the filter table to DROP. With the new ip-tables-forward-rules
flag a generic ACCEPT for all packages going from and to the pod subnet
is added to the FORWARD chain.
Fixes #241