From 1fc4cb90bff4d6e3cab6bb4d4de40903a8cef152 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Wed, 15 Apr 2026 12:06:26 +0200 Subject: [PATCH] Routed VR: accept packets from related and established connections (#12986) --- systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py index 80d64e8f2d9..93d0d0388ef 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py @@ -244,6 +244,8 @@ class CsNetfilters(object): CsHelper.execute("nft add chain %s %s %s '{ %s }'" % (address_family, table, chain, chain_policy)) if hook == "input" or hook == "output": CsHelper.execute("nft add rule %s %s %s icmp type { echo-request, echo-reply } accept" % (address_family, table, chain)) + elif hook == "forward": + CsHelper.execute("nft add rule %s %s %s ct state established,related accept" % (address_family, table, chain)) def apply_nft_ipv4_rules(self, rules, type): if len(rules) == 0: