Bug 1493955 – iptables -I FORWARD -d 172.30.0.0/16 -i eth1 -j ACCEPT' is needed while using flannel for openshift deployment on openstack for pod to pod communication present on different nodes.

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1493955 - iptables -I FORWARD -d 172.30.0.0/16 -i eth1 -j ACCEPT' is needed while using flannel for openshift deployment on openstack for pod to pod communication present on different nodes.

Summary:	iptables -I FORWARD -d 172.30.0.0/16 -i eth1 -j ACCEPT' is needed while using...

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Networking (Show other bugs)
Sub Component:
Version:	3.5.0
Hardware:	Unspecified Unspecified

Priority	unspecified Severity urgent
Target Milestone:	---
Target Release:	3.9.0
Assigned To:	Ivan Chavero
QA Contact:	Meng Bo
Docs Contact:

URL:
Whiteboard:
Keywords:

Duplicates:	1490820 (view as bug list)
Depends On:	1537105
Blocks:
	Show dependency tree / graph

Reported:	2017-09-21 04:24 EDT by Miheer Salunke
Modified:	2018-03-28 10:06 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-03-28 10:06:20 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Github	openshift/openshift-ansible/pull/5853	None	None	None	2017-10-30 08:50 EDT
Red Hat Product Errata	RHBA-2018:0489	None	None	None	2018-03-28 10:06 EDT

Groups: None (edit)

Description Miheer Salunke 2017-09-21 04:24:37 EDT

Description of problem:

After deploying OCP 3.5 on OpenStack 10 is it required

You need to set the following in the forward chain for pod to pod communication present on different nodes->

ansible nodes -b -m shell -a 'iptables -I FORWARD -d 172.30.0.0/16 -i eth1 -j ACCEPT'

where  172.30.0.0/16 is cluster or pod cidr and eth1 is used by flannel.

Version-Release number of selected component (if applicable):
 openshift 3.5 on Openstack 10, VMS have RHEL version 7.3

How reproducible:
Always

Steps to Reproduce:
1. deploy openshift 3.5 on Openstack 10, VMS have RHEL version 7.3
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Ben Bennett 2017-09-22 13:49:01 EDT

The rule:
  iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

was also needed

Comment 3 Ben Bennett 2017-10-17 11:00:19 EDT

Ivan, can you work with the installer team to see how we can get the above rules added to the ansible installer.

Comment 4 Ivan Chavero 2017-10-25 14:13:28 EDT

Created WIP Pull Request https://github.com/openshift/openshift-ansible/pull/5853

Comment 5 Ben Bennett 2017-12-07 09:12:56 EST

*** Bug 1490820 has been marked as a duplicate of this bug. ***

Comment 9 Meng Bo 2018-01-30 03:01:01 EST

Tested with openshift-ansible-3.9.0-0.31.0.git.0.e0a0ad8.el7.noarch.rpm the following iptables rules are added

-A POSTROUTING -o eth0 -m comment --comment "Allow external network access" -j MASQUERADE
-A FORWARD -d 10.128.0.0/14 -i eth0 -m comment --comment "Pod to Pod communication" -j ACCEPT

Comment 12 errata-xmlrpc 2018-03-28 10:06:20 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0489

Note You need to log in before you can comment on or make changes to this bug.