[netcf-devel] [PATCH 0/2] Remove code that modifies iptables config for bridges

Laine Stump laine at laine.org
Thu Sep 23 12:16:03 UTC 2010


  On 09/15/2010 11:52 AM, Laine Stump wrote:
> After having several bug reports of various netcf initialization
> failures related to this code, and an IRC discussion of the
> appropriateness of automatically tweaking firewall policy when
> examining interface configuration, we decided it was best to eliminate
> the code in netcf that modifies the iptables config to add this rule:
>
>     -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
>
> (see PATCH 2/2 for detailed reasons).
>
> Note that, even with this code removed, there is still one other
> related problem - if there are no bridges defined on the system at
> boot time (in /etc/sysconfig/network-scripts/ifcfg-*), the setting of
> net.bridge.bridge-nf-call-iptablesin sysctl.conf will not take effect,
> leaving the bridge module default setting of "1" in place. The result
> will be that (since the aforementioned iptables rule won't be added)
> that traffic will not pass on any newly defined bridges until 1) the
> network service is restarted (or some other procedure that causes
> "sysctl -a -p" to be run), or 2) the system is rebooted. Fixing that
> is beyond the scope of netcf, though.
>
> _______________________________________________
> netcf-devel mailing list
> netcf-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/netcf-devel
>

I had been waiting for any dissenting opinions before pushing these, and 
didn't get any, so I just pushed them.


More information about the netcf-devel mailing list