Uploaded image for project: 'Red Hat OpenStack Services on OpenShift'
  1. Red Hat OpenStack Services on OpenShift
  2. OSPRH-15473

Since nftables switch, input policy is ACCEPT instead of DROP up until nftables services is reloaded or server is rebooted

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Normal Normal
    • rhos-18.0.8
    • rhos-18.0 FR 2 (Mar 2025)
    • edpm-ansible
    • None
    • 4
    • False
    • Hide

      None

      Show
      None
    • False
    • ?
    • openstack-ansible-ee-container-1.0.10-3
    • None
    • Hide
      .Default policy ensures nftables reload at the end of deployment

      Before this update, iptables default tables were added to nftables to ensure backwards compatibility. However, there was a default ALLOW INPUT rule instead of a default DROP rule, and nftables were not reloaded at the end of the deployment. With this update, the correct rules are applied to ensure that nftables are reloaded at the end of the deployment.
      Show
      .Default policy ensures nftables reload at the end of deployment Before this update, iptables default tables were added to nftables to ensure backwards compatibility. However, there was a default ALLOW INPUT rule instead of a default DROP rule, and nftables were not reloaded at the end of the deployment. With this update, the correct rules are applied to ensure that nftables are reloaded at the end of the deployment.
    • Bug Fix
    • Done
    • EDPM Sprint 1
    • 1
    • 2025Q2
    • Important

      Since nftables switch, input policy is ACCEPT instead of DROP up until nftables service is reloaded or server is rebooted.  

      This is the difference between nft list ruleset before and after restarting nftables.

      @@ -1,6 +1,6 @@
 table inet filter {
        chain INPUT {
-               type filter hook input priority filter; policy accept;
+               type filter hook input priority filter; policy drop;
                jump TRIPLEO_INPUT
         }

       

      RHOSP17.1.4

              rhn-support-bshephar Brendan Shephard (Inactive)
              rhn-support-dhill Dave Hill
              rhos-dfg-df
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: