From 40d77460386342126fb5533a9139bf6d08137d1d Mon Sep 17 00:00:00 2001 From: Jayapal Date: Mon, 21 Aug 2017 22:34:40 +0530 Subject: [PATCH] CLOUDSTACK-9967: Fixed static nat iptables rules order issue on additional public subnet ip (#2154) --- .../patches/debian/config/opt/cloud/bin/configure.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/systemvm/patches/debian/config/opt/cloud/bin/configure.py b/systemvm/patches/debian/config/opt/cloud/bin/configure.py index a39e10baa29..252bd2cecba 100755 --- a/systemvm/patches/debian/config/opt/cloud/bin/configure.py +++ b/systemvm/patches/debian/config/opt/cloud/bin/configure.py @@ -928,12 +928,13 @@ class CsForwardingRules(CsDataBag): device = self.getDeviceByIp(rule["public_ip"]) if device is None: raise Exception("Ip address %s has no device in the ips databag" % rule["public_ip"]) + self.fw.append(["mangle", "", - "-A PREROUTING -s %s/32 -m state --state NEW -j MARK --set-xmark 0x%s/0xffffffff" % \ - (rule["internal_ip"], device[len("eth"):])]) - self.fw.append(["mangle", "", - "-A PREROUTING -s %s/32 -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" % \ + "-I PREROUTING -s %s/32 -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" % \ rule["internal_ip"]]) + self.fw.append(["mangle", "", + "-I PREROUTING -s %s/32 -m state --state NEW -j MARK --set-xmark 0x%s/0xffffffff" % \ + (rule["internal_ip"], device[len("eth"):])]) self.fw.append(["nat", "front", "-A PREROUTING -d %s/32 -j DNAT --to-destination %s" % (rule["public_ip"], rule["internal_ip"])]) self.fw.append(["nat", "front",