From b23466f588c4aad61c598a1d1d0ca5c3cce567d5 Mon Sep 17 00:00:00 2001 From: Ruakij Date: Tue, 3 Nov 2026 18:36:47 +0000 Subject: [PATCH] host_firewall: pass cluster ring flows from wt0 into the pod CIDR unmasqueraded and past the NetBird forward filter --- host_firewall/templates/host.nft.j2 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2 index c3f0f43..04ba25e 100644 --- a/host_firewall/templates/host.nft.j2 +++ b/host_firewall/templates/host.nft.j2 @@ -129,9 +129,13 @@ table inet host { {% if cluster.v4 is defined and cluster.v4.pods is defined %} # NetBird marks new flows in prerouting (priority mangle, -150) and masquerades marked ones in postrouting, which # rewrites the source of cross-node pod traffic and breaks Cilium identity and network policy when pod traffic passes - # the host stack (veth with legacy host routing). This chain runs right after and clears the marks for pod to pod flows. + # the host stack (veth with legacy host routing). This chain runs right after. Flows from the cluster ring (pods, + # node NetBird addresses) into the pod CIDR arriving on wt0 get mark 0x1bd20: not masqueraded, and accepted by the + # NetBird forward filter, which drops forwarded wt0 traffic that no route group allows. Other pod to pod flows + # lose their marks. chain pod_identity { type filter hook prerouting priority -140; policy accept; + iifname "wt0" ct state new ip saddr @cluster_v4 ip daddr {{ cluster.v4.pods }} meta mark set 0x0001bd20 ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd21 meta mark set 0 ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd22 meta mark set 0 }