Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: pass LAPI client flows from wt0 to the pod port with their own address

Browse Source
This commit is contained in:
Ruakij
2026-11-03 21:58:27 +00:00
parent b23466f588
commit f60a2c7e1f
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+5
View File
@@ -34,6 +34,11 @@ firewall:
ifaces: {}
v4: {}
v6: {}
# Hosts outside the ring that reach a NodePort service (CrowdSec LAPI) over wt0, and the port of its pods: Cilium
# translates the NodePort before netfilter, so the flows arrive as client -> pod:port.
lapi:
port: null
clients: {}
# IPv4 port forwards: name -> {daddr, to, tcp: ports, udp: ports}, ports as in
# the maps above. Forwarded traffic passes the forward hook, not input.
dnat: {}
host_firewall/templates/host.nft.j2
+11 -1
View File
@@ -30,6 +30,8 @@ set {{ name }} {
{% set guest_match = 'iifname { "' ~ (guest_ifaces | join('", "')) ~ '" }' %}
{% set dnat = firewall.dnat | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | list %}
{% set masquerade = firewall.masquerade | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') | unique | list %}
{% set lapi = cluster.lapi | default({}, true) %}
{% set lapi_rule = list(lapi.clients) and lapi.port %}
{% set scrapers = firewall.scrapers | default({}, true) %}
{% set forward_guard = firewall.forward_guard | default({}, true) | dict2items | rejectattr('value', 'none') | list %}
{% set blocklists = firewall.spamhaus or firewall.firehol %}
@@ -91,6 +93,9 @@ table inet host {
{{ addr_set('admin_v6', 'ipv6_addr', firewall.admin.v6) }}
{{ addr_set('cluster_v4', 'ipv4_addr', cluster.v4) }}
{{ addr_set('cluster_v6', 'ipv6_addr', cluster.v6) }}
{% if lapi_rule %}
{{ addr_set('lapi_clients_v4', 'ipv4_addr', lapi.clients) }}
{% endif %}
{{ addr_set('scrapers_v4', 'ipv4_addr', scrapers.v4) }}
{{ addr_set('scrapers_v6', 'ipv6_addr', scrapers.v6) }}
{{ addr_list_set('rl_exempt_v4', 'ipv4_addr', exempt_v4) }}
@@ -132,10 +137,15 @@ table inet host {
# the host stack (veth with legacy host routing). This chain runs right after. Flows from the cluster ring (pods,
# node NetBird addresses) into the pod CIDR arriving on wt0 get mark 0x1bd20: not masqueraded, and accepted by the
# NetBird forward filter, which drops forwarded wt0 traffic that no route group allows. Other pod to pod flows
# lose their marks.
# lose their marks. The same mark lets the LAPI clients (@lapi_clients_v4) reach the pod port of the NodePort service
# with their own address: Cilium has translated the NodePort before this point, so NetBird would masquerade the flow
# to the cilium_host address and the network policy would see world.
chain pod_identity {
type filter hook prerouting priority -140; policy accept;
iifname "wt0" ct state new ip saddr @cluster_v4 ip daddr {{ cluster.v4.pods }} meta mark set 0x0001bd20
{% if lapi_rule %}
iifname "wt0" ct state new ip saddr @lapi_clients_v4 ip daddr {{ cluster.v4.pods }} tcp dport {{ lapi.port }} meta mark set 0x0001bd20
{% endif %}
ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd21 meta mark set 0
ct state new ip saddr {{ cluster.v4.pods }} ip daddr {{ cluster.v4.pods }} meta mark 0x0001bd22 meta mark set 0
}