Skip to content
This repository has been archived by the owner on Feb 24, 2020. It is now read-only.

Fedora firewall rules caveat and DNS #2206

Open
dghubble opened this issue Feb 22, 2016 · 11 comments
Open

Fedora firewall rules caveat and DNS #2206

dghubble opened this issue Feb 22, 2016 · 11 comments
Labels
area/distribution area/networking depends-on/cni kind/documentation priority/P1
Milestone
v1+

Comments

@dghubble
Copy link
Contributor

The distributions doc metions that Fedora's firewall rules block traffic and recommend flushing the IP tables.

sudo iptables -F
sudo iptables -F -t nat

That works, but maybe that recommendation can be less destructive? Better to trust each rkt net?

sudo firewall-cmd --add-source=172.16.28.0/24 --zone=trusted

Maybe this is something CNI should address or does address?

Original Problem (for people Googling): Some minimal examples with alpine or busybox resolve DNS queries properly when run on a Debian/Ubuntu host, but fail on a Fedora host.

sudo rkt run quay.io/coreos/alpine-sh --interactive --exec=/bin/ash --volume dns,kind=host,source=/etc/resolv.conf --mount volume=dns,target=/etc/resolv.conf
sudo rkt run --dns=192.168.1.1 quay.io/coreos/alpine-sh --interactive --exec=/bin/ash --volume dns,kind=host,source=/etc/resolv.conf --mount volume=dns,target=/etc/resolv.conf

# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 192.168.1.1

# ping www.google.com
ping: bad address 'www.google.com'

# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=63 time=4.996 ms
64 bytes from 192.168.1.1: seq=1 ttl=63 time=28.807 ms
64 bytes from 192.168.1.1: seq=2 ttl=63 time=5.100 ms

Ping-able, but not DNS query-able.

Versions:

Fedora 23
rkt Version: 1.0.0
appc Version: 0.7.4
Go Version: go1.5.3
Go OS/Arch: linux/amd64
Features: -TPM
@dghubble dghubble changed the title Fedora DNS caveat and firewall rules Fedora firewall rules caveat and DNS Feb 22, 2016
@joshix joshix mentioned this issue Feb 23, 2016
Closed
6 tasks
@alban alban added this to the v1.2.0 milestone Feb 23, 2016
@alban alban mentioned this issue Feb 23, 2016
Open
3 tasks
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Feb 26, 2016
@alban
firewalld: integration
874d83c 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Related to: rkt/rkt#2206
@alban alban mentioned this issue Feb 26, 2016
Closed
@alban
Copy link
Member

alban commented Feb 26, 2016

Thanks for the commands! I am using firewall-cmd --add-source=172.16.28.0/24 --zone=trusted and firewall-cmd --remove-source=172.16.28.0/24 --zone=trusted in this CNI pull request:

containernetworking/cni#138

alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 3, 2016
@alban
firewalld: integration
4e1e045 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Related to: rkt/rkt#2206
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 7, 2016
@alban
firewalld: integration
dc63019 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Related to: rkt/rkt#2206
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 7, 2016
@alban
firewalld: integration
1d0d0af 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Related to: rkt/rkt#2206
@alban alban modified the milestones: v1.3.0, v1.2.0 Mar 18, 2016
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 21, 2016
@alban
firewalld: integration
ae2cfbf 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Related to: rkt/rkt#2206
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 21, 2016
@alban
firewalld: integration
28b2cac 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

See https://fedoraproject.org/wiki/FirewallD

Related to: rkt/rkt#2206
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 22, 2016
@alban
firewalld: integration
ec24546 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Supported plugins: ptp, bridge.

See https://fedoraproject.org/wiki/FirewallD

Related to: rkt/rkt#2206
alban added a commit to kinvolk-archives/appc-cni that referenced this issue Mar 29, 2016
@alban
firewalld: integration
efe7d1c 
On distributions using FirewallD like Fedora, we need to register the
new IP to FirewallD.

Supported plugins: ptp, bridge.

See https://fedoraproject.org/wiki/FirewallD

Related to: rkt/rkt#2206
@alban
Copy link
Member

alban commented Mar 31, 2016

Pending on the CNI PR. Moving to next milestone.

@alban alban modified the milestones: v1.4.0, v1.3.0 Mar 31, 2016
@jonboulle
Copy link
Contributor

still waiting on CNI?

@alban
Copy link
Member

alban commented Apr 13, 2016

@jonboulle yes. @steveej added a comment but I didn't have time to follow up.

@alban alban modified the milestones: v1.5.0, v1.4.0 Apr 13, 2016
@s-urbaniak s-urbaniak modified the milestones: v1.6.0, v1.5.0 Apr 28, 2016
@jonboulle jonboulle modified the milestones: v1+, v1.6.0 May 12, 2016
@jonboulle
Copy link
Contributor

Removing from specific milestone until firewall issues are followed up in CNI.

@philips
Copy link
Contributor

philips commented May 12, 2016

@rhatdan Is there anyone from the Fedora or RH community who would want to figure out how to integrate rkt and CNI with firewalld?

@alban
Copy link
Member

alban commented May 12, 2016

@philips there is a PR already (containernetworking/cni#138) but @steveej wanted to refactor it as a CNI plugin.

@rhatdan
Copy link
Contributor

rhatdan commented May 12, 2016

Best to open a bugzilla on rkt and then we can point the firewalld team at it. But this pull request looks like someone has been looking at it.

@kushaldas
Copy link

Do we have any update on this issue?

@jonathanunderwood
Copy link

Is the situation still the same? If so, would be great to update the docs to refer to current Fedora releases - 26 and 27. The docs refer to Fedora 24 and 25 which are EOL.

@dghubble
Copy link
Contributor Author

Yes, I believe this is still the case.

@vadorovsky vadorovsky mentioned this issue Feb 6, 2018
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
area/distribution area/networking depends-on/cni kind/documentation priority/P1
Projects
None yet
Milestone
v1+
Development

No branches or pull requests
9 participants
@alban @philips @kushaldas @s-urbaniak @iaguis @jonathanunderwood @rhatdan @dghubble @jonboulle