From c30b3d1f0aefba957c12876506f1da170b29f347 Mon Sep 17 00:00:00 2001 From: Ruakij Date: Tue, 3 Nov 2026 16:35:02 +0000 Subject: [PATCH] host_firewall: clear NetBird marks on pod to pod flows so pod sources stay unmasqueraded --- host_firewall/templates/host.nft.j2 | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2 index 20e1f79..60bd374 100644 --- a/host_firewall/templates/host.nft.j2 +++ b/host_firewall/templates/host.nft.j2 @@ -126,6 +126,17 @@ table inet host { } {% endif %} +{% if cluster.v4 is defined and cluster.v4.pods is defined %} + # NetBird marks new flows in prerouting (priority mangle, -150) and masquerades marked ones in postrouting, which + # rewrites the source of cross-node pod traffic and breaks Cilium identity and network policy when pod traffic passes + # the host stack (veth with legacy host routing). This chain runs right after and clears the marks for pod to pod flows. + chain pod_identity { + type filter hook prerouting priority -140; policy accept; + ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd21 meta mark set 0 + ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd22 meta mark set 0 + } + +{% endif %} chain input { type filter hook input priority filter; policy drop; {% if blocklists %}