VRRP traffic dropped by Cilium - CT: Unknown L4 protocol about cilium HOT 7 OPEN

This looks like a dup of #18347? Could you follow-up on the same issue?

from cilium.

Definitely related but not dup of the initial issue. I propose to retitle the issue; hostfirewall enabled/disabled has no effect on this issue in 1.15 and other protocols are impacted as well. seem to be a regression as it was working in my setup in 1.14

from cilium.

I just can confirm that this are two different bugs. One is related to host firewall (#18347) and this one is related to bpf masquerade somehow.

What can I observe:

• use keepalived with LAN ip4 - it's all OK
• use keepalived with WAN ip4 - I can see 2-4 vrrp packets after keepalived start, depending on nodes/ips and after that packets are dropped. After keepalived restart I can see again 2-4 vrrp packets.

This is all related to setup without host firewall. I'm preparing PR right now for the fix, but don't know if it's right fix (I'm not cilium maintainer).

from cilium.

@sbocahu, can you please tell what other protocols are impacted as well ? Is this also a multicast traffic ?

from cilium.

@kvaster OSPF is reported to be impacted as well: #18347 (comment)

from cilium.

OSPF is also based on multicast. But I should say that my fix is only for host multicast traffic without hostfirewall enabled.

from cilium.

I'm considering using hostFirewall in the future however for the time being I'ld be glad to upgrade to 1.15 so thank you very much @kvaster. Hope a new minor fixing this soon :) !

from cilium.