network/iptables: Add iptables rules to FORWARD chain #872
Conversation
|
It looks like the |
|
My intention was to drop that flag and to have flannel always write the iptables rules. In this PR, flannel is only changing rules for IP addresses that it owns, whereas in the other PR it was changing the default forward policy, which is global and therefore I figured should be optional. |
Documentation/troubleshooting.md
Outdated
| ## Connectivity | ||
| In Docker v1.13 and later, the default iptables forwarding policy was changed to `DROP`. For more detail on the Docker change, see the Docker [documentation](https://docs.docker.com/engine/userguide/networking/default_network/container-communication/#container-communication-between-hosts). | ||
|
|
||
| This problems manifests itself as connectivity problems between containers running on different hosts. To resolve it either run `iptables -P FORWARD ACCEPT` on every host (and on each reboot) or run flannel with the `--ip-forward` argument that was introduced in version v0.10.0. |
There was a problem hiding this comment.
Looks like --ip-forward should be dropped from documentation here.
|
@tomdee makes sense and I think dropping the flag is better |
|
Just a question, but do you know how Tectonic works around this? Do they just add the iptables rule from some script? |
|
@klausenbusk The Docker networking code does nothing (noops) if the sysctl |
Thanks, I didn't knew that. Then I'm not worried about upgrading to docker 17.x. |
|
I plan to merge this shortly as I'm not hearing any objections. Thanks @squeed for the info on CoreOS, that solves the mystery of why nobody was hitting this problem on CoreOS! |
To work around the Docker change from v1.13 which changed the default FORWARD policy to DROP. The change has bitten many many users. The troubleshooting documentation is also updated talk about the issue. Replaces PR flannel-io#862 Fixes flannel-io#834 Fixes flannel-io#823 Fixes flannel-io#609 Fixes flannel-io#799
tomdee
force-pushed
the
always-ipforward
branch
from
3e3a5b4 to
5df82dc
Compare
You mean v0.9.1 from quay.io/repository/coreos/flannel ? |
|
This is now fixed |
|
Thanks, I got stuck by this because I pulled the kube-flannel file 2 days ago. |
To work around the Docker change from v1.13 which
changed the default FORWARD policy to DROP.
The change has bitten many many users.
The troubleshooting documentation is also updated talk about the issue.
Replaces PR #862
Fixes #834
Fixes #823
Fixes #609
Fixes #799