Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Problem with IPv4 forwarding after kernel upgrade
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 303

PostPosted: Sun Jul 01, 2018 2:54 pm    Post subject: Problem with IPv4 forwarding after kernel upgrade Reply with quote

Hello.
I have Gentoo host system with qemu, libvirt, virt-manager and several guest OSes on it. Also there's two virtual networks between host and guests. It's because I need that some guests can enter the internet and some can't, but all must have access to the host ftp.
Host system has nftables that allows all (IPv4), but denies forwarding from 192.168.10.0/24 subnet (no internet). Other guests are connected to 192.168.20.0/24 and have internet access.
Here's nftables rules script:
Code:

#!/sbin/nft -f

# Delete all previous tables/rules
flush ruleset

# Table for IPv4 (type - ip, name - v4)
table ip v4 {
    chain prerouting {
       type nat hook prerouting priority 0;
    }

    chain input {
        type filter hook input priority 0; policy accept;
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
        ip saddr 192.168.10.0/24 drop comment "Drop unwanted transit NAT"
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority 100;
    }
}

# Table for IPv6 (type - ip6 , name - v6)
# Drop all IPv6 traffic
table ip6 v6 {
    chain input {
        type filter hook input priority 0; policy drop;
    }
                                                                                                                                                                                             
    chain forward {                                                                                                                                                                           
        type filter hook forward priority 0; policy drop;                                                                                                                                     
    }

    chain output {
        type filter hook output priority 0; policy drop;
    }
}

It was working fine till kernel upgrade (to 4.14.52). If nftables are started (openrc init) - all subnets don't have internet access (no difference 192.168.10.0/24 or 192.168.20.0/24), and If not started - all have.
Also, upgrade has changed ip forward setting at sysctl.conf to 0 (I have already back it to 1).
What can be the problem?
Back to top
View user's profile Send private message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 303

PostPosted: Mon Jul 02, 2018 3:02 pm    Post subject: Reply with quote

Solved after deleting pre- and postrouting chains from nftables script.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum