summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichele Baldessari <michele@acksyn.org>2017-01-27 10:54:28 +0100
committerMichele Baldessari <michele@acksyn.org>2017-01-27 10:54:28 +0100
commitd5d4cc1094365b6bb147216d2ec99ddc36020a31 (patch)
treeba11b84ace2fbcc5460b97bdab3ddbe188d286c6
parente47f6d7cbe3058bc32d6e18aa23c5f0c2007c53c (diff)
Add a default rule for dhcpv6 traffic
Via bug https://bugs.launchpad.net/tripleo/+bug/1657108 we need to zero out the default rules in /etc/sysconfig/ip{6}tables in the image. We have done this for ipv4, but when we will do it for ipv6 we will also need to make sure we add a rule for dhcpv6 traffic as it is shipped in the iptables rpm. (See https://bugzilla.redhat.com/show_bug.cgi?id=1169036 for more info) With this change we correctly get the rule present (aka the first ACCEPT line. The second line is due to the stock ip6tables rule I had in my testing): [root@overcloud-controller-0 ~]# iptables -nvL |grep 546 [root@overcloud-controller-0 ~]# ip6tables -nvL |grep 546 0 0 ACCEPT udp * * ::/0 fe80::/64 multiport dports 546 /* 004 accept ipv6 dhcpv6 ipv6 */ state NEW 0 0 ACCEPT udp * * ::/0 fe80::/64 udp dpt:546 state NEW Change-Id: If22080054b2b1fa7acfd101e8c34d2707e8e7864 Partial-Bug: #1657108
-rw-r--r--manifests/firewall/pre.pp6
1 files changed, 6 insertions, 0 deletions
diff --git a/manifests/firewall/pre.pp b/manifests/firewall/pre.pp
index 7af7fbc..39120d9 100644
--- a/manifests/firewall/pre.pp
+++ b/manifests/firewall/pre.pp
@@ -54,4 +54,10 @@ class tripleo::firewall::pre(
extras => $firewall_settings,
}
+ tripleo::firewall::rule{ '004 accept ipv6 dhcpv6':
+ dport => '546',
+ proto => 'udp',
+ state => ['NEW'],
+ destination => 'fe80::/64',
+ }
}