<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - systemd-networkd: could not enable IP masquerading untill iptables is touched"
href="https://bugs.freedesktop.org/show_bug.cgi?id=89269">89269</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>systemd-networkd: could not enable IP masquerading untill iptables is touched
</td>
</tr>
<tr>
<th>Product</th>
<td>systemd
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Assignee</th>
<td>systemd-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>wolf.ramovsky@gmail.com
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>systemd-bugs@lists.freedesktop.org
</td>
</tr></table>
<p>
<div>
<pre>Description:
I was playing around systemd-nspawn containers and new systemd-219 feature:
default masquerading veth'ed (started with --network-veth) containers, and
faced a weird systemd-networkd behaviour.
systemd-networkd could not enable or disable IP masquerading (and do any other
firewall related things like forwarding, I suppose) if iptables haven't been
touched anyhow since boot time.
How to reproduce:
The most important prerequisite here is that iptables haven't been touched
since boot time. iptables shouldn't be touched either by iptables-load from
iptables.service or manually from console.
Run
# iptables-save
and its output should be completely empty. Not tables with empty rules; just no
output at all.
1. Then prepare some distro in some directory to use with nspawn.
2. Start systemd-networkd on host.
3. Boot container with -n (--network-veth) option:
# systemd-nspawn -n -b -D $path_to_container
4. Try to ping from container: ping won't be able to reach anything.
5. See systemd-networkd status on host:
# systemctl status systemd-networkd
It will report:
systemd-networkd: ve-%containername% : Could not enable IP masquerading:
Protocol not avaliable
6. Turn off container.
7. Touch iptables, e. g.:
# iptables -t nat --list
After you have touched iptables in such way, iptables-save will output tables
with empty set of rules.
8. Now boot container and try to ping: voilà, it pings!
9. Check systemd-networkd status: there is no any complains now.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>