unkin-agent
b74bced771
Effective rp_filter is max(all, <iface>). Setting `all`/`default` to 0 is not enough after a reboot: `/usr/lib/sysctl.d/50-redhat.conf` sets `net.ipv4.conf.*.rp_filter = 1`, which udev applies to every interface as it is created, so routed asymmetric traffic gets dropped once shorewall goes. - add `net.ipv4.conf.*.rp_filter: 0` to the router role, overriding the vendor glob - disable `enforce` for it, since `sysctl -n` cannot read glob keys Reviewed-on: #539 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
31 lines
664 B
YAML
31 lines
664 B
YAML
---
|
|
hiera_include:
|
|
- frrouting
|
|
- exporters::frr_exporter
|
|
|
|
# routing
|
|
sysctl::base::values:
|
|
net.ipv4.ip_forward:
|
|
value: '1'
|
|
net.ipv4.conf.all.rp_filter:
|
|
value: '0'
|
|
net.ipv4.conf.default.rp_filter:
|
|
value: '0'
|
|
# overrides 50-redhat.conf's per-interface rp_filter=1 (applied by udev on link add); sysctl -n can't glob, so no enforce
|
|
net.ipv4.conf.*.rp_filter:
|
|
value: '0'
|
|
enforce: false
|
|
|
|
# frrouting
|
|
exporters::frr_exporter::enable: true
|
|
frrouting::ospfd_redistribute:
|
|
- connected
|
|
frrouting::daemons:
|
|
ospfd: true
|
|
|
|
# consul
|
|
profiles::consul::client::node_rules:
|
|
- resource: service
|
|
segment: frr_exporter
|
|
disposition: write
|