Skip to content

Instantly share code, notes, and snippets.

@Billy99

Billy99/IPv4 ipables and routes

Created August 21, 2020 21:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Billy99/940957e17fa307ce4079c09106418163 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Billy99/940957e17fa307ce4079c09106418163 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
IPv4 ipables and routes
$ docker exec -ti ovn-worker /bin/sh
#
#
# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
OVN-KUBE-EXTERNALIP all -- 0.0.0.0/0 0.0.0.0/0
OVN-KUBE-NODEPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OVN-KUBE-EXTERNALIP all -- 0.0.0.0/0 0.0.0.0/0
OVN-KUBE-NODEPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
OVN-KUBE-SNAT-MGMTPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-POSTROUTING all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes postrouting rules */
Chain KUBE-KUBELET-CANARY (0 references)
target prot opt source destination
Chain KUBE-MARK-DROP (0 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK or 0x8000
Chain KUBE-MARK-MASQ (2 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK or 0x4000
Chain KUBE-NODEPORTS (1 references)
target prot opt source destination
Chain KUBE-POSTROUTING (1 references)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000 random-fully
Chain KUBE-PROXY-CANARY (0 references)
target prot opt source destination
Chain KUBE-SEP-KYAKWNPZMT7TXG57 (1 references)
target prot opt source destination
KUBE-MARK-MASQ all -- 172.17.0.3 0.0.0.0/0 /* default/kubernetes:https */
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 /* default/kubernetes:https */ tcp to:172.17.0.3:6443
Chain KUBE-SERVICES (2 references)
target prot opt source destination
KUBE-MARK-MASQ tcp -- !10.244.0.0/16 10.96.0.1 /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-SVC-NPX46M4PTMTKRN6Y tcp -- 0.0.0.0/0 10.96.0.1 /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-NODEPORTS all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL
Chain KUBE-SVC-NPX46M4PTMTKRN6Y (1 references)
target prot opt source destination
KUBE-SEP-KYAKWNPZMT7TXG57 all -- 0.0.0.0/0 0.0.0.0/0 /* default/kubernetes:https */
Chain OVN-KUBE-EXTERNALIP (2 references)
target prot opt source destination
Chain OVN-KUBE-NODEPORT (2 references)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 172.17.0.4 tcp dpt:32527 to:10.108.220.212:80
Chain OVN-KUBE-SNAT-MGMTPORT (1 references)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 /* OVN SNAT to Management Port */ to:10.244.0.2
#
#
#
# ip route
default via 172.17.0.1 dev breth0
10.96.0.0/12 via 10.244.0.1 dev ovn-k8s-mp0
10.244.0.0/24 dev ovn-k8s-mp0 proto kernel scope link src 10.244.0.2
10.244.0.0/16 via 10.244.0.1 dev ovn-k8s-mp0
169.254.0.0/20 dev ovn-k8s-gw0 proto kernel scope link src 169.254.0.1
172.17.0.0/16 dev breth0 proto kernel scope link src 172.17.0.4
#
#
#
# exit
[bmcfall@nfvsdn-22-oot test]$
[bmcfall@nfvsdn-22-oot test]$
[bmcfall@nfvsdn-22-oot test]$
[bmcfall@nfvsdn-22-oot test]$ docker exec -ti ovn-worker2 /bin/sh
#
#
# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
OVN-KUBE-EXTERNALIP all -- 0.0.0.0/0 0.0.0.0/0
OVN-KUBE-NODEPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OVN-KUBE-EXTERNALIP all -- 0.0.0.0/0 0.0.0.0/0
OVN-KUBE-NODEPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
OVN-KUBE-SNAT-MGMTPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-POSTROUTING all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes postrouting rules */
Chain KUBE-KUBELET-CANARY (0 references)
target prot opt source destination
Chain KUBE-MARK-DROP (0 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK or 0x8000
Chain KUBE-MARK-MASQ (2 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK or 0x4000
Chain KUBE-NODEPORTS (1 references)
target prot opt source destination
Chain KUBE-POSTROUTING (1 references)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000 random-fully
Chain KUBE-PROXY-CANARY (0 references)
target prot opt source destination
Chain KUBE-SEP-KYAKWNPZMT7TXG57 (1 references)
target prot opt source destination
KUBE-MARK-MASQ all -- 172.17.0.3 0.0.0.0/0 /* default/kubernetes:https */
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 /* default/kubernetes:https */ tcp to:172.17.0.3:6443
Chain KUBE-SERVICES (2 references)
target prot opt source destination
KUBE-MARK-MASQ tcp -- !10.244.0.0/16 10.96.0.1 /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-SVC-NPX46M4PTMTKRN6Y tcp -- 0.0.0.0/0 10.96.0.1 /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-NODEPORTS all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL
Chain KUBE-SVC-NPX46M4PTMTKRN6Y (1 references)
target prot opt source destination
KUBE-SEP-KYAKWNPZMT7TXG57 all -- 0.0.0.0/0 0.0.0.0/0 /* default/kubernetes:https */
Chain OVN-KUBE-EXTERNALIP (2 references)
target prot opt source destination
Chain OVN-KUBE-NODEPORT (2 references)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 172.17.0.2 tcp dpt:32527 to:10.108.220.212:80
Chain OVN-KUBE-SNAT-MGMTPORT (1 references)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 /* OVN SNAT to Management Port */ to:10.244.2.2
#
#
# ip route
default via 172.17.0.1 dev breth0
10.96.0.0/12 via 10.244.2.1 dev ovn-k8s-mp0
10.244.0.0/16 via 10.244.2.1 dev ovn-k8s-mp0
10.244.2.0/24 dev ovn-k8s-mp0 proto kernel scope link src 10.244.2.2
169.254.0.0/20 dev ovn-k8s-gw0 proto kernel scope link src 169.254.0.1
172.17.0.0/16 dev breth0 proto kernel scope link src 172.17.0.2
#
$ docker exec -ti ovn-control-plane /bin/sh
#
#
# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
OVN-KUBE-EXTERNALIP all -- 0.0.0.0/0 0.0.0.0/0
OVN-KUBE-NODEPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OVN-KUBE-EXTERNALIP all -- 0.0.0.0/0 0.0.0.0/0
OVN-KUBE-NODEPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
OVN-KUBE-SNAT-MGMTPORT all -- 0.0.0.0/0 0.0.0.0/0
KUBE-POSTROUTING all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes postrouting rules */
Chain KUBE-KUBELET-CANARY (0 references)
target prot opt source destination
Chain KUBE-MARK-DROP (0 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK or 0x8000
Chain KUBE-MARK-MASQ (2 references)
target prot opt source destination
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK or 0x4000
Chain KUBE-NODEPORTS (1 references)
target prot opt source destination
Chain KUBE-POSTROUTING (1 references)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000 random-fully
Chain KUBE-PROXY-CANARY (0 references)
target prot opt source destination
Chain KUBE-SEP-KYAKWNPZMT7TXG57 (1 references)
target prot opt source destination
KUBE-MARK-MASQ all -- 172.17.0.3 0.0.0.0/0 /* default/kubernetes:https */
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 /* default/kubernetes:https */ tcp to:172.17.0.3:6443
Chain KUBE-SERVICES (2 references)
target prot opt source destination
KUBE-MARK-MASQ tcp -- !10.244.0.0/16 10.96.0.1 /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-SVC-NPX46M4PTMTKRN6Y tcp -- 0.0.0.0/0 10.96.0.1 /* default/kubernetes:https cluster IP */ tcp dpt:443
KUBE-NODEPORTS all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL
Chain KUBE-SVC-NPX46M4PTMTKRN6Y (1 references)
target prot opt source destination
KUBE-SEP-KYAKWNPZMT7TXG57 all -- 0.0.0.0/0 0.0.0.0/0 /* default/kubernetes:https */
Chain OVN-KUBE-EXTERNALIP (2 references)
target prot opt source destination
Chain OVN-KUBE-NODEPORT (2 references)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 172.17.0.3 tcp dpt:32527 to:10.108.220.212:80
Chain OVN-KUBE-SNAT-MGMTPORT (1 references)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 /* OVN SNAT to Management Port */ to:10.244.1.2
#
#
#
# ip route
default via 172.17.0.1 dev breth0
10.96.0.0/12 via 10.244.1.1 dev ovn-k8s-mp0
10.244.0.0/16 via 10.244.1.1 dev ovn-k8s-mp0
10.244.1.0/24 dev ovn-k8s-mp0 proto kernel scope link src 10.244.1.2
169.254.0.0/20 dev ovn-k8s-gw0 proto kernel scope link src 169.254.0.1
172.17.0.0/16 dev breth0 proto kernel scope link src 172.17.0.3
#
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment