This rule exists after running an installation. However, it prevents traffic from leaving the SDN. SDN ping: nsenter -n -t 4817 -- ping 10.1.0.1 PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.536 ms non-SDN ping with rule: [root@ose3-node1 ~]# nsenter -n -t 4817 -- ping -c1 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. From 10.1.1.1 icmp_seq=1 Destination Host Prohibited Remove rule and ping works: [root@ose3-node1 ~]# iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited [root@ose3-node1 ~]# [root@ose3-node1 ~]# nsenter -n -t 4817 -- ping -c1 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=45 time=88.3 ms
Actually, now that I think about it, this probably ought to be fixed in openshift-sdn (and, unlike the port 4789 problem, it actually can be fixed there).
Seem like this bug and BZ#1273294 have the same cause root.
should be fixed in origin master
*** Bug 1273294 has been marked as a duplicate of this bug. ***
Check on puddle on [3.1/2015-10.27.1] The iptable rules have been added. User can deploy pod successfully. Can access www.baidu.com in the pod
Doesn't appear to be working: atomic-openshift-3.0.2.905-0.git.0.85d6f88.el7aos.x86_64 atomic-openshift-clients-3.0.2.905-0.git.0.85d6f88.el7aos.x86_64 atomic-openshift-master-3.0.2.905-0.git.0.85d6f88.el7aos.x86_64 atomic-openshift-node-3.0.2.905-0.git.0.85d6f88.el7aos.x86_64 atomic-openshift-sdn-ovs-3.0.2.905-0.git.0.85d6f88.el7aos.x86_64 atomic-openshift-utils-3.0.6-1.git.36.3d3f287.el7aos.noarch openshift-ansible-3.0.6-1.git.36.3d3f287.el7aos.noarch openshift-ansible-filter-plugins-3.0.6-1.git.36.3d3f287.el7aos.noarch openshift-ansible-lookup-plugins-3.0.6-1.git.36.3d3f287.el7aos.noarch openshift-ansible-playbooks-3.0.6-1.git.36.3d3f287.el7aos.noarch openshift-ansible-roles-3.0.6-1.git.36.3d3f287.el7aos.noarch tuned-profiles-atomic-openshift-node-3.0.2.905-0.git.0.85d6f88.el7aos.x86_64 Post-installation with the quick installer, I still have: [root@ose3-master ~]# iptables-save | grep -i reject -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited
Right, the fix was to add new rules to unfirewall specific traffic: -A FORWARD -d ${CLUSTER_NETWORK} -j ACCEPT -A FORWARD -s ${CLUSTER_NETWORK} -j ACCEPT (Previously those rules only got installed if firewalld was running. Now they're always installed.)
NVM this seems to be working. Sorry for the noise -- I didn't realize the resolution wasn't to remove that rule!
This fix is available in OpenShift Enterprise 3.1.