Uploaded image for project: 'Red Hat OpenStack Services on OpenShift'
  1. Red Hat OpenStack Services on OpenShift
  2. OSPRH-14047

nftables firewall doesn't have default drop rule anymore. As a result, all traffic is allowed

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Major Major
    • rhos-17.1.6
    • rhos-17.1.z
    • tripleo-ansible
    • None
    • 4
    • False
    • Hide

      None

      Show
      None
    • False
    • ?
    • tripleo-ansible-3.3.1-17.1.20250228030959.8debef3.el9ost
    • None
    • Hide
      .Default policy ensures nftables reload at the end of deployment

      Before this update, iptables default tables were added to nftables to ensure backwards compatibility. However, there was a default ALLOW INPUT rule instead of a default DROP rule, and nftables were not reloaded at the end of the deployment. With this update, the correct rules are applied to ensure that nftables are reloaded at the end of the deployment.
      Show
      .Default policy ensures nftables reload at the end of deployment Before this update, iptables default tables were added to nftables to ensure backwards compatibility. However, there was a default ALLOW INPUT rule instead of a default DROP rule, and nftables were not reloaded at the end of the deployment. With this update, the correct rules are applied to ensure that nftables are reloaded at the end of the deployment.
    • Bug Fix
    • Done
    • EDPM Sprint 1
    • 1
    • Critical

      To Reproduce Steps to reproduce the behavior: check nftables rules on any overcloud node

      Expected behavior chains with firewall rules should either have a rule at the end to drop all traffic that wasn't matched by allow rules or should have a drop policy

      Bug impact: firewall doesn't work anymore after update to RHOSP 17.1.4 and above

      Known workaround: to manually add a drop rule

      Additional context

      IMO we need to return a separate drop rule and keep logging rule optional

              drosenfe David Rosenfeld
              rhn-support-astupnik Alex Stupnikov
              rhos-dfg-df
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: