Skip to content

Commit fa0e05a

Browse files
wenyingdwenyingd
committed
Install iptables rules to allow wireguard packets
This change is to actively configure the iptables rules wireguard.port when wireguard is used as the encryption mode. This can fix traffic issues if the Node is configured with iptables default DROP policy. Signed-off-by: Wenying Dong <[email protected]>
1 parent c33622c commit fa0e05a

File tree

6 files changed

+360
-37
lines changed

6 files changed

+360
-37
lines changed

‎cmd/antrea-agent/agent.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,9 @@ func run(o *Options) error {
244244
multicastEnabled,
245245
o.config.SNATFullyRandomPorts,
246246
*o.config.Egress.SNATFullyRandomPorts,
247-
serviceCIDRProvider)
247+
serviceCIDRProvider,
248+
wireguardConfig.Port,
249+
)
248250
if err != nil {
249251
return fmt.Errorf("error creating route client: %v", err)
250252
}

‎docs/network-requirements.md

+15-12
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,24 @@
33
Antrea has a few network requirements to get started, ensure that your hosts and
44
firewalls allow the necessary traffic based on your configuration.
55

6-
| Configuration | Host(s) | Protocols/Ports | Other |
7-
|------------------------------------------------|---------------------------------------|--------------------------------------------|------------------------------|
8-
| Antrea with VXLAN enabled | All | UDP 4789 | |
9-
| Antrea with Geneve enabled | All | UDP 6081 | |
10-
| Antrea with STT enabled | All | TCP 7471 | |
11-
| Antrea with GRE enabled | All | IP Protocol ID 47 | No support for IPv6 clusters |
12-
| Antrea with IPsec ESP enabled | All | IP protocol ID 50 and 51, UDP 500 and 4500 | |
13-
| Antrea with WireGuard enabled | All | UDP 51820 | |
14-
| Antrea Multi-cluster with WireGuard encryption | Multi-cluster Gateway Node | UDP 51821 | |
15-
| Antrea with feature BGPPolicy enabled | Selected by user-provided BGPPolicies | TCP 179<sup>[1]</sup> | |
16-
| All | Kube-apiserver host | TCP 443 or 6443<sup>[2]</sup> | |
17-
| All | All | TCP 10349, 10350, 10351, UDP 10351 | |
6+
| Configuration | Host(s) | Protocols/Ports | Configurable | Other |
7+
|------------------------------------------------|---------------------------------------|--------------------------------------------|--------------|------------------------------|
8+
| Antrea with VXLAN enabled | All | UDP 4789 | Yes | |
9+
| Antrea with Geneve enabled | All | UDP 6081 | Yes | |
10+
| Antrea with STT enabled | All | TCP 7471 | Yes | |
11+
| Antrea with GRE enabled | All | IP Protocol ID 47 | No | No support for IPv6 clusters |
12+
| Antrea with IPsec ESP enabled | All | IP protocol ID 50 and 51, UDP 500 and 4500 | No | |
13+
| Antrea with WireGuard enabled | All | UDP 51820<sup>[3]</sup> | Yes | |
14+
| Antrea Multi-cluster with WireGuard encryption | Multi-cluster Gateway Node | UDP 51821 | Yes | |
15+
| Antrea with feature BGPPolicy enabled | Selected by user-provided BGPPolicies | TCP 179<sup>[1]</sup> | Yes | |
16+
| All | Kube-apiserver host | TCP 443 or 6443<sup>[2]</sup> | No | |
17+
| All | All | TCP 10349, 10350, 10351, UDP 10351 | No | |
1818

1919
[1] _The default value is 179, but a user created BGPPolicy can assign a different
2020
port number._
2121

2222
[2] _The value is passed to kube-apiserver `--secure-port` flag. You can find the port
2323
number from the output of `kubectl get svc kubernetes -o yaml`._
24+
25+
[3] _Antrea now automatically adds the firewall rules to allow the WireGuard packets,
26+
so the manual configuration on the host is not needed._

‎pkg/agent/route/route_linux.go

+67-22
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/containernetworking/plugins/pkg/ip"
2929
"github.com/vishvananda/netlink"
3030
"golang.org/x/sys/unix"
31+
"k8s.io/apimachinery/pkg/util/intstr"
3132
"k8s.io/apimachinery/pkg/util/sets"
3233
"k8s.io/apimachinery/pkg/util/wait"
3334
"k8s.io/klog/v2"
@@ -158,10 +159,17 @@ type Client struct {
158159
nodeNetworkPolicyIPTablesIPv4 sync.Map
159160
// nodeNetworkPolicyIPTablesIPv6 caches all existing IPv6 iptables chains and rules for NodeNetworkPolicy.
160161
nodeNetworkPolicyIPTablesIPv6 sync.Map
162+
// wireguardIPTablesIPv4 caches all existing IPv4 iptables chains and rules for WireGuard.
163+
wireguardIPTablesIPv4 sync.Map
164+
// wireguardIPTablesIPv6 caches all existing IPv6 iptables chains and rules for WireGuard.
165+
wireguardIPTablesIPv6 sync.Map
161166
// deterministic represents whether to write iptables chains and rules for NodeNetworkPolicy deterministically when
162167
// syncIPTables is called. Enabling it may carry a performance impact. It's disabled by default and should only be
163168
// used in testing.
164169
deterministic bool
170+
// wireguardPort is the port used for the WireGuard UDP tunnels. When WireGuard is enabled (used as the encryption
171+
// mode), we add iptables rules to the filter table to accept input and output UDP traffic destined to this port.
172+
wireguardPort int
165173
}
166174

167175
// NewClient returns a route client.
@@ -173,7 +181,8 @@ func NewClient(networkConfig *config.NetworkConfig,
173181
multicastEnabled bool,
174182
nodeSNATRandomFully bool,
175183
egressSNATRandomFully bool,
176-
serviceCIDRProvider servicecidr.Interface) (*Client, error) {
184+
serviceCIDRProvider servicecidr.Interface,
185+
wireguardPort int) (*Client, error) {
177186
return &Client{
178187
networkConfig: networkConfig,
179188
noSNAT: noSNAT,
@@ -194,6 +203,7 @@ func NewClient(networkConfig *config.NetworkConfig,
194203
antreaExternalIPIPSet: {},
195204
antreaExternalIPIP6Set: {},
196205
},
206+
wireguardPort: wireguardPort,
197207
}, nil
198208
}
199209

@@ -265,7 +275,9 @@ func (c *Client) Initialize(nodeConfig *config.NodeConfig, done func()) error {
265275
if c.nodeNetworkPolicyEnabled {
266276
c.initNodeNetworkPolicy()
267277
}
268-
278+
if c.networkConfig.TrafficEncryptionMode == config.TrafficEncryptionModeWireGuard {
279+
c.initWireguard()
280+
}
269281
return nil
270282
}
271283

@@ -675,7 +687,7 @@ func (c *Client) syncIPTables() error {
675687
if c.proxyAll {
676688
jumpRules = append(jumpRules, jumpRule{iptables.NATTable, iptables.OutputChain, antreaOutputChain, "Antrea: jump to Antrea output rules", true})
677689
}
678-
if c.nodeNetworkPolicyEnabled {
690+
if c.nodeNetworkPolicyEnabled || c.networkConfig.TrafficEncryptionMode == config.TrafficEncryptionModeWireGuard {
679691
jumpRules = append(jumpRules, jumpRule{iptables.FilterTable, iptables.InputChain, antreaInputChain, "Antrea: jump to Antrea input rules", false})
680692
jumpRules = append(jumpRules, jumpRule{iptables.FilterTable, iptables.OutputChain, antreaOutputChain, "Antrea: jump to Antrea output rules", false})
681693
}
@@ -711,20 +723,22 @@ func (c *Client) syncIPTables() error {
711723
return true
712724
})
713725

714-
nodeNetworkPolicyIPTablesIPv4 := map[string][]string{}
715-
nodeNetworkPolicyIPTablesIPv6 := map[string][]string{}
716-
c.nodeNetworkPolicyIPTablesIPv4.Range(func(key, value interface{}) bool {
717-
chain := key.(string)
718-
rules := value.([]string)
719-
nodeNetworkPolicyIPTablesIPv4[chain] = rules
720-
return true
721-
})
722-
c.nodeNetworkPolicyIPTablesIPv6.Range(func(key, value interface{}) bool {
723-
chain := key.(string)
724-
rules := value.([]string)
725-
nodeNetworkPolicyIPTablesIPv6[chain] = rules
726-
return true
727-
})
726+
addFilterRulesToChain := func(iptablesRulesByChain map[string][]string, m *sync.Map) {
727+
m.Range(func(key, value interface{}) bool {
728+
chain := key.(string)
729+
rules := value.([]string)
730+
iptablesRulesByChain[chain] = append(iptablesRulesByChain[chain], rules...)
731+
return true
732+
})
733+
}
734+
735+
iptablesFilterRulesByChainV4 := make(map[string][]string)
736+
addFilterRulesToChain(iptablesFilterRulesByChainV4, &c.wireguardIPTablesIPv4)
737+
addFilterRulesToChain(iptablesFilterRulesByChainV4, &c.nodeNetworkPolicyIPTablesIPv4)
738+
739+
iptablesFilterRulesByChainV6 := make(map[string][]string)
740+
addFilterRulesToChain(iptablesFilterRulesByChainV6, &c.wireguardIPTablesIPv6)
741+
addFilterRulesToChain(iptablesFilterRulesByChainV6, &c.nodeNetworkPolicyIPTablesIPv6)
728742

729743
// Use iptables-restore to configure IPv4 settings.
730744
if c.networkConfig.IPv4Enabled {
@@ -737,7 +751,7 @@ func (c *Client) syncIPTables() error {
737751
config.VirtualNodePortDNATIPv4,
738752
config.VirtualServiceIPv4,
739753
snatMarkToIPv4,
740-
nodeNetworkPolicyIPTablesIPv4,
754+
iptablesFilterRulesByChainV4,
741755
false)
742756

743757
// Setting --noflush to keep the previous contents (i.e. non antrea managed chains) of the tables.
@@ -757,7 +771,7 @@ func (c *Client) syncIPTables() error {
757771
config.VirtualNodePortDNATIPv6,
758772
config.VirtualServiceIPv6,
759773
snatMarkToIPv6,
760-
nodeNetworkPolicyIPTablesIPv6,
774+
iptablesFilterRulesByChainV6,
761775
true)
762776
// Setting --noflush to keep the previous contents (i.e. non antrea managed chains) of the tables.
763777
if err := c.iptables.Restore(iptablesData.String(), false, true); err != nil {
@@ -777,7 +791,7 @@ func (c *Client) restoreIptablesData(podCIDR *net.IPNet,
777791
nodePortDNATVirtualIP,
778792
serviceVirtualIP net.IP,
779793
snatMarkToIP map[uint32]net.IP,
780-
nodeNetWorkPolicyIPTables map[string][]string,
794+
iptablesFiltersRuleByChain map[string][]string,
781795
isIPv6 bool) *bytes.Buffer {
782796
// Create required rules in the antrea chains.
783797
// Use iptables-restore as it flushes the involved chains and creates the desired rules
@@ -897,7 +911,7 @@ func (c *Client) restoreIptablesData(podCIDR *net.IPNet,
897911
writeLine(iptablesData, iptables.MakeChainLine(antreaForwardChain))
898912

899913
var nodeNetworkPolicyIPTablesChains []string
900-
for chain := range nodeNetWorkPolicyIPTables {
914+
for chain := range iptablesFiltersRuleByChain {
901915
nodeNetworkPolicyIPTablesChains = append(nodeNetworkPolicyIPTablesChains, chain)
902916
}
903917
if c.deterministic {
@@ -937,7 +951,7 @@ func (c *Client) restoreIptablesData(podCIDR *net.IPNet,
937951
}...)
938952
}
939953
for _, chain := range nodeNetworkPolicyIPTablesChains {
940-
for _, rule := range nodeNetWorkPolicyIPTables[chain] {
954+
for _, rule := range iptablesFiltersRuleByChain[chain] {
941955
writeLine(iptablesData, rule)
942956
}
943957
}
@@ -1198,6 +1212,37 @@ func (c *Client) initNodeNetworkPolicy() {
11981212
}
11991213
}
12001214

1215+
func (c *Client) initWireguard() {
1216+
wireguardPort := intstr.FromInt(c.wireguardPort)
1217+
antreaInputChainRules := []string{
1218+
iptables.NewRuleBuilder(antreaInputChain).
1219+
SetComment("Antrea: allow WireGuard input packets").
1220+
MatchTransProtocol(iptables.ProtocolUDP).
1221+
MatchPortDst(&wireguardPort, nil).
1222+
SetTarget(iptables.AcceptTarget).
1223+
Done().
1224+
GetRule(),
1225+
}
1226+
antreaOutputChainRules := []string{
1227+
iptables.NewRuleBuilder(antreaOutputChain).
1228+
SetComment("Antrea: allow WireGuard output packets").
1229+
MatchTransProtocol(iptables.ProtocolUDP).
1230+
MatchPortDst(&wireguardPort, nil).
1231+
SetTarget(iptables.AcceptTarget).
1232+
Done().
1233+
GetRule(),
1234+
}
1235+
1236+
if c.networkConfig.IPv6Enabled {
1237+
c.wireguardIPTablesIPv6.Store(antreaInputChain, antreaInputChainRules)
1238+
c.wireguardIPTablesIPv6.Store(antreaOutputChain, antreaOutputChainRules)
1239+
}
1240+
if c.networkConfig.IPv4Enabled {
1241+
c.wireguardIPTablesIPv4.Store(antreaInputChain, antreaInputChainRules)
1242+
c.wireguardIPTablesIPv4.Store(antreaOutputChain, antreaOutputChainRules)
1243+
}
1244+
}
1245+
12011246
// Reconcile removes orphaned podCIDRs from ipset and removes routes to orphaned podCIDRs
12021247
// based on the desired podCIDRs.
12031248
func (c *Client) Reconcile(podCIDRs []string) error {

0 commit comments

Comments
 (0)