Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make iptables-nft the default iptables implementation #264

Closed
wants to merge 1 commit into from
Closed

Make iptables-nft the default iptables implementation #264

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions manifests/fedora-coreos-base.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,23 @@ postprocess:
setsebool -P -N container_use_cephfs on # RHBZ#1692369
setsebool -P -N virt_use_samba on # RHBZ#1754825

# Make iptables-nft the default iptables implementation by raising its priority
# above (from 5 to 15) iptables-legacy's priority (10) with `update-alternatives`.
# This will be dropped once iptables-nft becomes the default implementation in F32.
# https://github.com/coreos/fedora-coreos-tracker/issues/342
- |
#!/usr/bin/env bash
set -xeuo pipefail
pfx=/usr/sbin/iptables
pfx6=/usr/sbin/ip6tables
update-alternatives --install $pfx iptables $pfx-nft 15 \
--slave $pfx6 ip6tables $pfx6-nft \
--slave $pfx-restore iptables-restore $pfx-nft-restore \
--slave $pfx-save iptables-save $pfx-nft-save \
--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
--slave $pfx6-save ip6tables-save $pfx6-nft-save
update-alternatives --auto iptables

packages:
# Security
- selinux-policy-targeted
Expand Down