unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Persist rp_filter=0 on every router interface (#539)

Browse Source 
Effective rp_filter is max(all, <iface>). Setting `all`/`default` to 0 is not enough after a reboot: `/usr/lib/sysctl.d/50-redhat.conf` sets `net.ipv4.conf.*.rp_filter = 1`, which udev applies to every interface as it is created, so routed asymmetric traffic gets dropped once shorewall goes.

- add `net.ipv4.conf.*.rp_filter: 0` to the router role, overriding the vendor glob
- disable `enforce` for it, since `sysctl -n` cannot read glob keys

Reviewed-on: #539
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #539.
This commit is contained in:
Unkin Agent
2026-10-04 16:02:00 +11:00
committed by BenVincent
parent 0cfe598f90
commit b74bced771
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hieradata/roles/infra/network/router.yaml
+4
View File
@@ -11,6 +11,10 @@ sysctl::base::values:
value: '0' value: '0'
net.ipv4.conf.default.rp_filter: net.ipv4.conf.default.rp_filter:
value: '0' value: '0'
# overrides 50-redhat.conf's per-interface rp_filter=1 (applied by udev on link add); sysctl -n can't glob, so no enforce
net.ipv4.conf.*.rp_filter:
value: '0'
enforce: false
# frrouting # frrouting
exporters::frr_exporter::enable: true exporters::frr_exporter::enable: true