From d5d4cc1094365b6bb147216d2ec99ddc36020a31 Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Fri, 27 Jan 2017 10:54:28 +0100 Subject: Add a default rule for dhcpv6 traffic Via bug https://bugs.launchpad.net/tripleo/+bug/1657108 we need to zero out the default rules in /etc/sysconfig/ip{6}tables in the image. We have done this for ipv4, but when we will do it for ipv6 we will also need to make sure we add a rule for dhcpv6 traffic as it is shipped in the iptables rpm. (See https://bugzilla.redhat.com/show_bug.cgi?id=1169036 for more info) With this change we correctly get the rule present (aka the first ACCEPT line. The second line is due to the stock ip6tables rule I had in my testing): [root@overcloud-controller-0 ~]# iptables -nvL |grep 546 [root@overcloud-controller-0 ~]# ip6tables -nvL |grep 546 0 0 ACCEPT udp * * ::/0 fe80::/64 multiport dports 546 /* 004 accept ipv6 dhcpv6 ipv6 */ state NEW 0 0 ACCEPT udp * * ::/0 fe80::/64 udp dpt:546 state NEW Change-Id: If22080054b2b1fa7acfd101e8c34d2707e8e7864 Partial-Bug: #1657108 --- manifests/firewall/pre.pp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/manifests/firewall/pre.pp b/manifests/firewall/pre.pp index 7af7fbc..39120d9 100644 --- a/manifests/firewall/pre.pp +++ b/manifests/firewall/pre.pp @@ -54,4 +54,10 @@ class tripleo::firewall::pre( extras => $firewall_settings, } + tripleo::firewall::rule{ '004 accept ipv6 dhcpv6': + dport => '546', + proto => 'udp', + state => ['NEW'], + destination => 'fe80::/64', + } } -- cgit 1.2.3-korg