{"action":"created","issue":{"url":"https://api.github.com/repos/ibotty/blog-posts/issues/1","labels_url":"https://api.github.com/repos/ibotty/blog-posts/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/ibotty/blog-posts/issues/1/comments","events_url":"https://api.github.com/repos/ibotty/blog-posts/issues/1/events","html_url":"https://github.com/ibotty/blog-posts/issues/1","id":119996219,"number":1,"title":"firewalld seems to be preventing the flannel+libreswan setup ","user":{"login":"robtaireeo","id":2374685,"avatar_url":"https://avatars.githubusercontent.com/u/2374685?v=3","gravatar_id":"","url":"https://api.github.com/users/robtaireeo","html_url":"https://github.com/robtaireeo","followers_url":"https://api.github.com/users/robtaireeo/followers","following_url":"https://api.github.com/users/robtaireeo/following{/other_user}","gists_url":"https://api.github.com/users/robtaireeo/gists{/gist_id}","starred_url":"https://api.github.com/users/robtaireeo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robtaireeo/subscriptions","organizations_url":"https://api.github.com/users/robtaireeo/orgs","repos_url":"https://api.github.com/users/robtaireeo/repos","events_url":"https://api.github.com/users/robtaireeo/events{/privacy}","received_events_url":"https://api.github.com/users/robtaireeo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-02T17:37:37Z","updated_at":"2015-12-02T20:24:33Z","closed_at":null,"body":"Sorry to create an issue, but I am unsure where to post/ask for help.\r\n\r\nI have followed your blog post and was wonder if you could help?\r\n\r\nI have 2 RHEL machines with docker, flannel, libreswan installed and firewalld enabled with ipsec allowed and masquerade turned (external zone)\r\n\r\nA (10.64.152.97, 172.32.63.1/24)\r\nB (10.22.3.178, 172.32.1.1/24)\r\n\r\nI run a simple hello world web server docker image on A.\r\n\r\nIf I disable the firewalld service on B, I can successfully curl 172.32.63.2:8080 (container on A).\r\n\r\nOnce I enable the firewalld service on B, i cannot.\r\n\r\nI see some unreachable ICMPs on B with tcpdump, I assume I am missing some firewall rules.\r\n\r\nAny help would be appreciated."},"comment":{"url":"https://api.github.com/repos/ibotty/blog-posts/issues/comments/161422840","html_url":"https://github.com/ibotty/blog-posts/issues/1#issuecomment-161422840","issue_url":"https://api.github.com/repos/ibotty/blog-posts/issues/1","id":161422840,"user":{"login":"robtaireeo","id":2374685,"avatar_url":"https://avatars.githubusercontent.com/u/2374685?v=3","gravatar_id":"","url":"https://api.github.com/users/robtaireeo","html_url":"https://github.com/robtaireeo","followers_url":"https://api.github.com/users/robtaireeo/followers","following_url":"https://api.github.com/users/robtaireeo/following{/other_user}","gists_url":"https://api.github.com/users/robtaireeo/gists{/gist_id}","starred_url":"https://api.github.com/users/robtaireeo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robtaireeo/subscriptions","organizations_url":"https://api.github.com/users/robtaireeo/orgs","repos_url":"https://api.github.com/users/robtaireeo/repos","events_url":"https://api.github.com/users/robtaireeo/events{/privacy}","received_events_url":"https://api.github.com/users/robtaireeo/received_events","type":"User","site_admin":false},"created_at":"2015-12-02T20:24:33Z","updated_at":"2015-12-02T20:24:33Z","body":"- I am using vxlan\r\n- I did use the fixup ipsec script :)\r\n\r\nAs far as I can tell (tcpdump is showing esp packets), the ipsec tunnel is working when i disable both firewalld services on both boxes; so i agree its a double masquerading issue.\r\n\r\nI will get the the iptables output when i get back to work."}}