-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unable to add firewall rules to IP Tables: Nomad enforces first rule #10180
Comments
Looks like that link needs to be https://www.cni.dev/plugins/current/meta/firewall/#forward:
This seems reasonable to me. The existing behavior was added in 99742f2 and the doc comment here from @nickethier is awfully suggestive that I might be missing something as to why that could be a problem. So tagging him and @shoenig for a consult here. |
Thanks for taking a look! I believe the linked PR that I made is completely backwards compatible, as the |
@tgross @nickethier Not sure what the usual time frame for responding is, so apologies if I am prematurely following up and there is a process in place / queue that I am not aware of! Would just love to know the if the associated PR is something that could be merged, or if I need to find an alternative solution / workaround |
No worries about pinging us, especially after I totally said we'd look at it. I wanted to do some testing to make sure we understood what would happen around Nomad client restarts and it looks ok. Going to take one more pass over it in the next day or so and then merge if there's nothing we run into. |
Thank you very much for the quick response! Sounds excellent to me :) |
#10181 has been merged and will ship in the upcoming Nomad 1.1.0 |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
Nomad v1.0.4 (9294f35)
Issue
I am unable to add any additional firewall rules to the
NOMAD-ADMIN
IPTables chain, as nomad enforces that its ACCEPT rule is the first rule. So any rules that I append before nomad runs, are skipped.This seems to be the offending line:
nomad/client/allocrunner/networking_bridge_linux.go
Line 78 in a82697a
Is there any reason to ensure it's always the first rule?
According to https://www.cni.dev/plugins/meta/firewall/
The admin chain
is intended as an user-controlled chain for custom rules that run prior to rules managed by the firewall plugin
Reproduction steps
Add an IP Tables rule before nomad runs to the
NOMAD-ADMIN
chain. Run nomad with a container that exposes a port.Expected Result
Nomad to append its rule, so any existing rules are executed first.
Actual Result
Rule is ignored as nomad enforces its rule to be first
The text was updated successfully, but these errors were encountered: