Bug 1473366 - Firewall rules prevent appliance from getting a dynamic IPv6 address
Summary: Firewall rules prevent appliance from getting a dynamic IPv6 address
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: Appliance
Version: 5.8.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: GA
: 5.9.0
Assignee: Nick Carboni
QA Contact: luke couzens
URL:
Whiteboard: ipv6:black
Depends On:
Blocks: 1473424
TreeView+ depends on / blocked
 
Reported: 2017-07-20 15:40 UTC by Jan Krocil
Modified: 2018-03-06 14:32 UTC (History)
5 users (show)

Fixed In Version: 5.9.0.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1473424 (view as bug list)
Environment:
Last Closed: 2018-03-06 14:32:30 UTC
Category: Bug
Cloudforms Team: ---
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Jan Krocil 2017-07-20 15:40:20 UTC
Description of problem:
SSIA

Version-Release number of selected component (if applicable):
5.8.1.2

How reproducible:
Always

Steps to Reproduce:
1. Get a fresh appliance with no IPv4 networking; IPv6 only
2. Start the appliance up
3. # ip a

Actual results:
The appliance has no IPv6 ULA assigned (it only has a link local address). 

Expected results:
The appliance has IPv6 ULA successfully assigned from the DHCP server.

Additional info:


Workaround:
-----------
1. systemctl stop firewalld
   or
   ip6tables -F
2. systemctl restart network

At this point, the IPv6 address is correctly assigned to the iface.

Comment 2 Jan Krocil 2017-07-20 16:02:39 UTC
Better workaround:
------------------
We need to open port 546/udp in the active zone.

# firewall-cmd --zone=manageiq --add-port=546/udp --permanent
# firewall-cmd --reload
# systemctl restart network

Comment 4 CFME Bot 2017-07-20 18:57:48 UTC
New commit detected on ManageIQ/manageiq-appliance-build/master:
https://github.com/ManageIQ/manageiq-appliance-build/commit/75b970ce3b03ffca237237cbd4abf12e19639286

commit 75b970ce3b03ffca237237cbd4abf12e19639286
Author:     Nick Carboni <ncarboni>
AuthorDate: Thu Jul 20 13:33:28 2017 -0400
Commit:     Nick Carboni <ncarboni>
CommitDate: Thu Jul 20 13:33:28 2017 -0400

    Allow the DHCPv6 client through the appliance firewall
    
    Before this change appliances would not correctly receive IPv6
    addresses via DHCP.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1473366

 kickstarts/partials/post/firewalld.ks.erb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comment 6 luke couzens 2017-10-12 08:51:07 UTC
Verified in 5.9.0.2


Note You need to log in before you can comment on or make changes to this bug.