Comment 6 for bug 1554177

Revision history for this message
Sergey Yudin (tsipa740) wrote :

Hi. Guys, i've double checked and apparently i can't reproduce the issue anymore.

I've reched the original issue and it seems like originaly it was problem with two NATed networks - public and admin(PXE).

ADMIN(PXE) network rules:
-A FORWARD -d 10.109.0.0/24 -o fuelbr10805 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.109.0.0/24 -i fuelbr10805 -j ACCEPT
-A FORWARD -i fuelbr10805 -o fuelbr10805 -j ACCEPT
-A FORWARD -o fuelbr10805 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i fuelbr10805 -j REJECT --reject-with icmp-port-unreachable

PUB network:
-A FORWARD -d 10.109.3.0/24 -o fuelbr10808 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.109.3.0/24 -i fuelbr10808 -j ACCEPT
-A FORWARD -i fuelbr10808 -o fuelbr10808 -j ACCEPT
-A FORWARD -o fuelbr10808 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i fuelbr10808 -j REJECT --reject-with icmp-port-unreachable

If ADMIN net will be injected earlier than PUB
packets from 10.109.0.1 to 10.109.3.1 will be processed by
-A FORWARD -s 10.109.0.0/24 -i fuelbr10805 -j ACCEPT

otherwise, when PUB injected before ADMIN same packets will be processed by
-A FORWARD -o fuelbr10808 -j REJECT --reject-with icmp-port-unreachable

That leads to false positive tests of ostf tests which was supposed to failed because of absence of connectivity from PXE net to PUB net.

Apparently i can't see the presence of the issue anywhere now. Let's close the bug for a while, i will report you when i will see the env with this problem.