From c1fc002359131e827f683a9f0b27f5cd121d2a80 Mon Sep 17 00:00:00 2001 From: Rakesh Date: Fri, 20 Aug 2021 13:17:45 +0200 Subject: [PATCH] Fix iptable rules when chain reference count is 0 (#5328) Sometimes the chain reference count is 0 and in that case proper iptables rules are not applied. Because of this, ping fails. So check the reference count for the main chain and as well as -IN and -OUT chain as well Co-authored-by: Rakesh Venkatesh --- scripts/vm/network/security_group.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/vm/network/security_group.py b/scripts/vm/network/security_group.py index 404edd4e94d..a42ac345e23 100755 --- a/scripts/vm/network/security_group.py +++ b/scripts/vm/network/security_group.py @@ -1327,9 +1327,11 @@ def add_fw_framework(brname): try: refs = int(execute("""iptables -n -L %s | awk '/%s(.*)references/ {gsub(/\(/, "") ;print $3}'""" % (brfw,brfw)).strip()) + refs_in = int(execute("""iptables -n -L %s-IN | awk '/%s-IN(.*)references/ {gsub(/\(/, "") ;print $3}'""" % (brfw,brfw)).strip()) + refs_out = int(execute("""iptables -n -L %s-OUT | awk '/%s-OUT(.*)references/ {gsub(/\(/, "") ;print $3}'""" % (brfw,brfw)).strip()) refs6 = int(execute("""ip6tables -n -L %s | awk '/%s(.*)references/ {gsub(/\(/, "") ;print $3}'""" % (brfw,brfw)).strip()) - if refs == 0: + if refs == 0 or refs_in == 0 or refs_out == 0: execute("iptables -I FORWARD -i " + brname + " -j DROP") execute("iptables -I FORWARD -o " + brname + " -j DROP") execute("iptables -I FORWARD -i " + brname + " -m physdev --physdev-is-bridged -j " + brfw)