From 639b9bca5d0438a510b456bd4f5a4296c18543b6 Mon Sep 17 00:00:00 2001 From: Lars Ekman Date: Thu, 15 Sep 2022 07:49:12 +0200 Subject: [PATCH] Corrects target in the KUBE-IPVS-FILTER chain The target was "ACCEPT" which disabled any other check like loadBalancerSourceRanges in the KUBE-PROXY-FIREWALL chain. The target is now "RETURN". --- pkg/proxy/ipvs/proxier.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/proxy/ipvs/proxier.go b/pkg/proxy/ipvs/proxier.go index 0ce180f4e24..e57e5901dcf 100644 --- a/pkg/proxy/ipvs/proxier.go +++ b/pkg/proxy/ipvs/proxier.go @@ -1807,13 +1807,13 @@ func (proxier *Proxier) writeIptablesRules() { // https://github.com/kubernetes/kubernetes/issues/72236 proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), - "-m", "set", "--match-set", proxier.ipsetList[kubeLoadBalancerSet].Name, "dst,dst", "-j", "ACCEPT") + "-m", "set", "--match-set", proxier.ipsetList[kubeLoadBalancerSet].Name, "dst,dst", "-j", "RETURN") proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), - "-m", "set", "--match-set", proxier.ipsetList[kubeClusterIPSet].Name, "dst,dst", "-j", "ACCEPT") + "-m", "set", "--match-set", proxier.ipsetList[kubeClusterIPSet].Name, "dst,dst", "-j", "RETURN") proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), - "-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "ACCEPT") + "-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "RETURN") proxier.filterRules.Write( "-A", string(kubeIPVSFilterChain), "-m", "conntrack", "--ctstate", "NEW",