From b74bced771da83b194baaca8f40a9486dff4e503 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 4 Oct 2026 16:02:00 +1100 Subject: [PATCH] Persist rp_filter=0 on every router interface (#539) Effective rp_filter is max(all, ). Setting `all`/`default` to 0 is not enough after a reboot: `/usr/lib/sysctl.d/50-redhat.conf` sets `net.ipv4.conf.*.rp_filter = 1`, which udev applies to every interface as it is created, so routed asymmetric traffic gets dropped once shorewall goes. - add `net.ipv4.conf.*.rp_filter: 0` to the router role, overriding the vendor glob - disable `enforce` for it, since `sysctl -n` cannot read glob keys Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/539 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- hieradata/roles/infra/network/router.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hieradata/roles/infra/network/router.yaml b/hieradata/roles/infra/network/router.yaml index 91ef40b..e3d35ae 100644 --- a/hieradata/roles/infra/network/router.yaml +++ b/hieradata/roles/infra/network/router.yaml @@ -11,6 +11,10 @@ sysctl::base::values: value: '0' net.ipv4.conf.default.rp_filter: value: '0' + # overrides 50-redhat.conf's per-interface rp_filter=1 (applied by udev on link add); sysctl -n can't glob, so no enforce + net.ipv4.conf.*.rp_filter: + value: '0' + enforce: false # frrouting exporters::frr_exporter::enable: true