RP filtering drops requests incoming via IPIP tunnels on ncredir realservers
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Vgutierrez
	Nov 28 2023, 10:43 AM

Description

kfree_skb_reason(SKB_DROP_REASON_IP_RPFILTER) 198.35.26.12:12250->198.35.26.98:80(tcp)

tested from bast4004 with a simple scapy script

	Subject	Repo	Branch	Lines +/-
	hiera: Disable rp filter on ncredir@ulsfo	operations/puppet	production	+1 -0
	base::sysctl: Allow disabling rp_filter	operations/puppet	production	+13 -7

Status	Assigned	Task
In Progress	Vgutierrez	T332027 Replace current L4LB with with Katran-based alternative
Resolved	Vgutierrez	T348837 Investigate IPVS IPIP encapsulation support
Resolved	Vgutierrez	T351069 Enable IPIP encapsulation for ncredir
Resolved	Vgutierrez	T352160 RP filtering drops requests incoming via IPIP tunnels on ncredir realservers

Vgutierrez triaged this task as High priority.Nov 28 2023, 10:44 AM

Change 978038 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] lvs::realserver: Disable RP filter

Change 978088 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] base::sysctl: Allow disabling rp_filter

Change 978088 merged by Vgutierrez:

[operations/puppet@production] base::sysctl: Allow disabling rp_filter

Change 978038 merged by Vgutierrez:

[operations/puppet@production] hiera: Disable rp filter on ncredir@ulsfo