UFW in swift-storage affects GRE traffic

[David Ames]

When using colocating swift-storage and neutron-openvswitch, GRE traffic
is marked INVALID.

Need to modprobe nf_conntrack_proto_gre to fix [0].

[0] http://northernmost.org/blog/gre-tunnels-and-ufw/index.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/555089

[Felipe Reyes (freyes)]

On Wed, Mar 21, 2018 at 11:12:12PM -0000, David Ames wrote:
> Public bug reported:
>
> When using colocating swift-storage and neutron-openvswitch, GRE traffic
> is marked INVALID.
>
> Need to modprobe nf_conntrack_proto_gre to fix [0].

I wonder if in this situation the charm should also increase the
ip_conntrack_max[0] sysctl key.

[0] /proc/sys/net/ipv4/ip_conntrack_max

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Ames (<email address hidden>) on branch: master
Review: https://review.openstack.org/555089
Reason: This approach did not work.

[Edward Hope-Morley (hopem)]

Adding the following to the top of /etc/ufw/before.rules (and restarting ufw) fixed this for me:

-A ufw-before-input -p 47 -j ACCEPT

[David Ames (thedac)]

On Tue, May 1, 2018 at 6:16 AM, Edward Hope-Morley
<email address hidden> wrote:
> Adding the following to the top of /etc/ufw/before.rules (and restarting
> ufw) fixed this for me:
>
> -A ufw-before-input -p 47 -j ACCEPT
>

This is what we are trying to implement. Getting the change into ufw
without it erroring is the challenge.

I should have something to test shortly.

http://northernmost.org/blog/gre-tunnels-and-ufw/index.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/565557

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Ames (<email address hidden>) on branch: master
Review: https://review.openstack.org/565557
Reason: Superseded by another PR.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/566001
Committed: https://git.openstack.org/cgit/openstack/charm-swift-storage/commit/?id=18d0a891db6e794d3ddabf2ff45f4acf80283094
Submitter: Zuul
Branch: master

commit 18d0a891db6e794d3ddabf2ff45f4acf80283094
Author: David Ames <email address hidden>
Date: Tue May 1 10:14:54 2018 -0700

    Allow GRE traffic in converged architecture

    In a converged architecture with storage and compute on the same
    host, UFW can get in the way of tunneled traffic interpreting it as
    INVALID. UFW makes solving this more difficult than it needs to be.
    See http://northernmost.org/blog/gre-tunnels-and-ufw/index.html for
    context.

    This change updates /etc/ufw/before.rules to add GRE as an allowed
    input.

    Also, guarantee ufw is installed for LP #1763716

    Please review and merge charm-helpers first:
    https://github.com/juju/charm-helpers/pull/170

    Change-Id: I789854c33e3af12f7412633dbf7c921beb0ed2b5
    Closes-Bug: #1757564
    Closes-Bug: #1763716