Skip to content

Instantly share code, notes, and snippets.

@anfernee

anfernee/debug-note.md

Last active July 17, 2022 11:09
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save anfernee/b7b17f758c6b271572c60c9f80fa5d7e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save anfernee/b7b17f758c6b271572c60c9f80fa5d7e to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. anfernee revised this gist Feb 2, 2021. 1 changed file with 8 additions and 0 deletions.
    8 changes: 8 additions & 0 deletions debug-note.md
    View file
    Original file line number Diff line number Diff line change
    @@ -8,4 +8,12 @@
    -A CILIUM_POST_nat -s 127.0.0.1/32 -o cilium_host -m comment --comment "cilium host->cluster from 127.0.0.1 masquerade" -j SNAT --to-source 10.11.1.253
    -A CILIUM_POST_nat -o cilium_host -m mark --mark 0xf00/0xf00 -m conntrack --ctstate DNAT -m comment --comment "hairpin traffic that originated from a local pod" -j SNAT --to-source 10.11.1.253
    ```


    Delete the SNAT rule:

    ```
    # iptables -t nat -D CILIUM_POST_nat 1
    # iptables -t nat -L CILIUM_POST_nat
    ```
  2. anfernee revised this gist Feb 2, 2021. 1 changed file with 11 additions and 0 deletions.
    11 changes: 11 additions & 0 deletions debug-note.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,11 @@
    ```
    # First rule SNAT the packet that comes out of the gw node
    -A CILIUM_POST_nat -s 10.11.1.0/24 ! -d 10.11.0.0/16 ! -o cilium_+ -m comment --comment "cilium masquerade non-cluster" -j MASQUERADE
    -A CILIUM_POST_nat ! -o cilium_host -m comment --comment "exclude non-cilium_host traffic from masquerade" -j RETURN
    -A CILIUM_POST_nat -m mark --mark 0xa00/0xe00 -m comment --comment "exclude proxy return traffic from masquarade" -j ACCEPT
    -A CILIUM_POST_nat ! -s 10.11.1.253/32 ! -d 10.11.1.0/24 -o cilium_host -m comment --comment "cilium host->cluster masquerade" -j SNAT --to-source 10.11.1.253
    -A CILIUM_POST_nat -s 127.0.0.1/32 -o cilium_host -m comment --comment "cilium host->cluster from 127.0.0.1 masquerade" -j SNAT --to-source 10.11.1.253
    -A CILIUM_POST_nat -o cilium_host -m mark --mark 0xf00/0xf00 -m conntrack --ctstate DNAT -m comment --comment "hairpin traffic that originated from a local pod" -j SNAT --to-source 10.11.1.253
    ```
  3. anfernee created this gist Jul 24, 2020.
    32 changes: 32 additions & 0 deletions egress.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,32 @@
    kind: GatewayClass
    metadata:
    name: CloudNAT
    provider: cloud-nat
    spec:
    region: us-central1
    level: premium
    ---
    kind: Gateway
    metadata:
    name: the-gateway
    namespace: default
    spec:
    egressIP: 1.1.1.1
    exportTo:
    kind: EgressRoute
    namespace: my-app
    name: my-app
    ---
    kind: EgressRoute
    metadata:
    namespace: my-app
    name: my-app
    spec:
    match:
    selector:
    app: web
    destination:
    - ip: 4.4.4.4
    route:
    kind: Gateway
    name: db-gateway