Bug 1551499

Description of problem:
Setting up an ocp-3.9 cluster which is using flannel network, found it couldn't resolve domain name from the pod.

[root@ip-172-18-7-127 ~]# oc rsh docker-registry-1-bhghf
sh-4.2$ curl www.google.com
curl: (6) Could not resolve host: www.google.com; Unknown error

It looks like a same issue with BZ#1490820, which was fixed along with BZ#1493955. Checked the iptables rules on master and node, the required rules in BZ#1493955 are both added, but the domain name resolution still not work. The full iptables rules list on the master could be found in attachment.

Also tried the workaround in https://bugzilla.redhat.com/show_bug.cgi?id=1490820#c0, adding the following iptables rules could solve the issue.
# iptables -A OS_FIREWALL_ALLOW -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
# iptables -A OS_FIREWALL_ALLOW -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT


Version-Release number of the following components:
openshift-ansible-3.9.2-1.git.0.1a855b3.el7.noarch.rpm

How reproducible:
Always

Steps to Reproduce:
1. Enable flannel network used in ocp-3.9, check the pod
openshift_use_openshift_sdn=false
openshift_use_flannel=true


Actual results:
Please include the entire output from the last TASK line through the end of output if an error is generated

Expected results:

Additional info:
Please attach logs from ansible-playbook with the -vvv flag