[netcf-devel] [PATCH 0/2] Remove code that modifies iptables config for bridges

David Lutterkort lutter at redhat.com
Thu Sep 16 18:47:32 UTC 2010


On Wed, 2010-09-15 at 11:52 -0400, Laine Stump wrote:
> After having several bug reports of various netcf initialization
> failures related to this code, and an IRC discussion of the
> appropriateness of automatically tweaking firewall policy when
> examining interface configuration, we decided it was best to eliminate
> the code in netcf that modifies the iptables config to add this rule:
> 
>    -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
> 
> (see PATCH 2/2 for detailed reasons).

Looks good.

> Note that, even with this code removed, there is still one other
> related problem - if there are no bridges defined on the system at
> boot time (in /etc/sysconfig/network-scripts/ifcfg-*), the setting of
> net.bridge.bridge-nf-call-iptablesin sysctl.conf will not take effect,
> leaving the bridge module default setting of "1" in place. The result
> will be that (since the aforementioned iptables rule won't be added)
> that traffic will not pass on any newly defined bridges until 1) the
> network service is restarted (or some other procedure that causes
> "sysctl -a -p" to be run), or 2) the system is rebooted. Fixing that
> is beyond the scope of netcf, though.

Is there a bz for this ? It seems very strange to me that there is a
difference between apparent configuration and actual configuration for
this.

David




More information about the netcf-devel mailing list