Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: pass cluster ring flows from wt0 into the pod CIDR unmasqueraded and past the NetBird forward filter

Browse Source
This commit is contained in:
Ruakij
2026-11-03 18:36:47 +00:00
parent 74a0af2d32
commit b23466f588
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+5 -1
View File
@@ -129,9 +129,13 @@ table inet host {
{% if cluster.v4 is defined and cluster.v4.pods is defined %}
# NetBird marks new flows in prerouting (priority mangle, -150) and masquerades marked ones in postrouting, which
# rewrites the source of cross-node pod traffic and breaks Cilium identity and network policy when pod traffic passes
# the host stack (veth with legacy host routing). This chain runs right after and clears the marks for pod to pod flows.
# the host stack (veth with legacy host routing). This chain runs right after. Flows from the cluster ring (pods,
# node NetBird addresses) into the pod CIDR arriving on wt0 get mark 0x1bd20: not masqueraded, and accepted by the
# NetBird forward filter, which drops forwarded wt0 traffic that no route group allows. Other pod to pod flows
# lose their marks.
chain pod_identity {
type filter hook prerouting priority -140; policy accept;
iifname "wt0" ct state new ip saddr @cluster_v4 ip daddr {{ cluster.v4.pods }} meta mark set 0x0001bd20
ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd21 meta mark set 0
ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd22 meta mark set 0
}