diff --git a/pkg/controllers/proxy/network_services_controller.go b/pkg/controllers/proxy/network_services_controller.go index c0ebbc87..52410dfb 100644 --- a/pkg/controllers/proxy/network_services_controller.go +++ b/pkg/controllers/proxy/network_services_controller.go @@ -1276,6 +1276,16 @@ func (nsc *NetworkServicesController) deleteBadMasqueradeIptablesRules() error { {"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "!", "-s", nsc.podCidr, "!", "-d", nsc.podCidr, "-j", "MASQUERADE"}, } + // If random fully is supported remove the original rules as well + if iptablesCmdHandler.HasRandomFully() { + argsBad = append(argsBad, []string{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "-j", "SNAT", "--to-source", nsc.nodeIP.String()}) + + if len(nsc.podCidr) > 0 { + argsBad = append(argsBad, []string{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", + "!", "-s", nsc.podCidr, "!", "-d", nsc.podCidr, "-j", "SNAT", "--to-source", nsc.nodeIP.String()}) + } + } + for _, args := range argsBad { exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...) if err != nil { diff --git a/pkg/controllers/routing/pod_egress.go b/pkg/controllers/routing/pod_egress.go index f9d53aef..1fa1e261 100644 --- a/pkg/controllers/routing/pod_egress.go +++ b/pkg/controllers/routing/pod_egress.go @@ -91,6 +91,16 @@ func (nrc *NetworkRoutingController) deleteBadPodEgressRules() error { if nrc.isIpv6 { podEgressArgsBad = podEgressArgsBad6 } + + // If random fully is supported remove the original rule as well + if iptablesCmdHandler.HasRandomFully() { + if !nrc.isIpv6 { + podEgressArgsBad = append(podEgressArgsBad, podEgressArgs4) + } else { + podEgressArgsBad = append(podEgressArgsBad, podEgressArgs6) + } + } + for _, args := range podEgressArgsBad { exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...) if err != nil {