Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[caclmgrd] Don't limit iptables connection tracking to TCP #4796

Merged
merged 1 commit into from
Jun 18, 2020
Merged

[caclmgrd] Don't limit iptables connection tracking to TCP #4796

merged 1 commit into from
Jun 18, 2020

Conversation

jleveque
Copy link
Contributor

  • Don't limit iptables connection tracking to TCP protocol; allow connection tracking for all protocols. This allows services like NTP, which is UDP-based, to receive replies from an NTP server even if the port is blocked, as long as it is in reply to a request sent from the device itself.

@jleveque jleveque requested a review from lguohan June 18, 2020 00:29
@jleveque jleveque self-assigned this Jun 18, 2020
@jleveque jleveque merged commit 6960477 into sonic-net:master Jun 18, 2020
@jleveque jleveque deleted the caclmgrd_conntrack_all branch June 18, 2020 07:18
yxieca pushed a commit that referenced this pull request Jun 19, 2020
@jleveque @yxieca
[caclmgrd] Don't limit connection tracking to TCP (#4796)
d9b8bed 
Don't limit iptables connection tracking to TCP protocol; allow connection tracking for all protocols. This allows services like NTP, which is UDP-based, to receive replies from an NTP server even if the port is blocked, as long as it is in reply to a request sent from the device itself.
abdosi pushed a commit that referenced this pull request Jun 20, 2020
@jleveque @abdosi
[caclmgrd] Don't limit connection tracking to TCP (#4796)
d8886ba 
Don't limit iptables connection tracking to TCP protocol; allow connection tracking for all protocols. This allows services like NTP, which is UDP-based, to receive replies from an NTP server even if the port is blocked, as long as it is in reply to a request sent from the device itself.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lguohan lguohan lguohan approved these changes

Assignees

@jleveque jleveque

Labels
Control Plane ACL Included in 201811 Branch Included in 201911 Branch Request for 201811 Branch :shipit: Request for 201911 Branch :shipit:
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@jleveque @lguohan @yxieca @abdosi