From 7b9435898d2696fae92fc23b26469d8f8159030a Mon Sep 17 00:00:00 2001 From: Minhan Xia Date: Wed, 8 Jun 2016 17:33:14 -0700 Subject: [PATCH] Accept ICMP in INPUT/FORWARD chain of filter table --- cluster/gce/gci/configure-helper.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/cluster/gce/gci/configure-helper.sh b/cluster/gce/gci/configure-helper.sh index f5c1cde1582..20a386c344a 100644 --- a/cluster/gce/gci/configure-helper.sh +++ b/cluster/gce/gci/configure-helper.sh @@ -24,16 +24,18 @@ set -o pipefail function config-ip-firewall { echo "Configuring IP firewall rules" # The GCI image has host firewall which drop most inbound/forwarded packets. - # We need to add rules to accept all TCP/UDP packets. + # We need to add rules to accept all TCP/UDP/ICMP packets. if iptables -L INPUT | grep "Chain INPUT (policy DROP)" > /dev/null; then - echo "Add rules to accept all inbound TCP/UDP packets" + echo "Add rules to accept all inbound TCP/UDP/ICMP packets" iptables -A INPUT -w -p TCP -j ACCEPT iptables -A INPUT -w -p UDP -j ACCEPT + iptables -A INPUT -w -p ICMP -j ACCEPT fi if iptables -L FORWARD | grep "Chain FORWARD (policy DROP)" > /dev/null; then - echo "Add rules to accept all forwarded TCP/UDP packets" + echo "Add rules to accept all forwarded TCP/UDP/ICMP packets" iptables -A FORWARD -w -p TCP -j ACCEPT iptables -A FORWARD -w -p UDP -j ACCEPT + iptables -A FORWARD -w -p ICMP -j ACCEPT fi }