Bug 1653384

Summary: [3.7] firewalld reload causes namespace wide egress IP to stop working
Product: OpenShift Container Platform Reporter: Dan Winship <danw>
Component: NetworkingAssignee: Dan Winship <danw>
Status: CLOSED ERRATA QA Contact: Meng Bo <bmeng>
Severity: high Docs Contact:
Priority: high    
Version: 3.7.1CC: aos-bugs, bmeng, mcurry, tibrahim, vlaad, weliang
Target Milestone: ---Keywords: NeedsTestCase
Target Release: 3.7.z   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: Egress IP-related iptables rules were not recreated if they got deleted. Consequence: If a user restarted firewalld or iptables.service on a node that hosted egress IPs, then those egress IPs would stop working. (Traffic that should have used the egress IP would use the node's normal IP instead.) Fix: Egress IP iptables rules are now recreated if they are removed. Result: Egress IPs work reliably.
Story Points: ---
Clone Of: 1643304 Environment:
Last Closed: 2019-08-07 15:02:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Comment 1 Dan Winship 2018-11-26 17:13:07 UTC

Comment 2 Weibin Liang 2018-12-11 14:41:04 UTC
Tested and passed in v3.7.76

[root@host-172-16-122-9 ~]# iptables -t nat -L | grep 161
SNAT       all  --        anywhere             mark match 0x73cf7e to:
[root@host-172-16-122-9 ~]# firewall-cmd --reload
[root@host-172-16-122-9 ~]# iptables -t nat -L | grep 161
SNAT       all  --        anywhere             mark match 0x73cf7e to:
[root@host-172-16-122-9 ~]#