MitchDrage opened a new issue, #14619:
URL: https://github.com/apache/cloudstack/issues/14619
### problem
At boot, `postinit.sh` runs `nft -f /etc/iptables/rules.nftables`. That file
is saved with `nft list ruleset`, so on routers other than routed mode it also
contains the iptables-nft tables, which nft can't parse. The whole restore
fails:
```
/etc/iptables/rules.nftables:74:42-59: Error: unsupported xtables compat
expression, use iptables-nft with this ruleset
udp dport 68 counter packets 0 bytes 0 xt target CHECKSUM
```
IPv4 rules come back from `rules.v4`. The IPv6 firewall and ACLs only exist
in nftables and `rules.v6` is empty, so guest IPv6 is unfiltered until
CloudStack sends the router its config again.
A start or reboot from CloudStack does that straight away. After a reboot
from the router's shell, the rules stay missing until something makes
CloudStack resend them, such as a firewall or ACL rule change or a network
restart.
Routed-mode routers aren't affected. They have no iptables tables, so their
saved file restores fine.
This is an edge case, as routers are normally rebooted from CloudStack. A
router should still come back up without errors after a reboot from its own
shell.
### versions
CloudStack 4.22.1.1, system VM template with nftables 1.0.6 (Debian 12), KVM
on AlmaLinux 9.8.
### The steps to reproduce the bug
1. On any isolated network's virtual router, run `nft -c -f
/etc/iptables/rules.nftables`. It fails with the error above.
2. On an isolated network with IPv6, add an IPv6 firewall rule that allows
inbound ICMP from one address only. Pings from any other address are blocked.
3. Reboot the router from its console (`reboot`).
4. After boot, `nft list tables` has no `ip6 ip6_firewall` table, and pings
from any address reach the guest.
### What to do about it?
Today `rules.nftables` holds the whole ruleset, iptables tables included,
and those break the restore. Saving every table except the iptables ones
(`filter`, `nat`, `mangle`, `raw`, `security`) fixes it, as those are already
saved in `rules.v4`.
I tested this in a lab with isolated, VPC, routed and plain routers. The
IPv6 firewall and ACLs came back after a simulated boot, and IPv4 rules were
unchanged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
