Skip to content

fix(control): disable rp_filter in dae netns - #1079

Open
Zhanfg wants to merge 1 commit into
daeuniverse:mainfrom
Zhanfg:fix/daens-rp-filter-1078
Open

fix(control): disable rp_filter in dae netns#1079
Zhanfg wants to merge 1 commit into
daeuniverse:mainfrom
Zhanfg:fix/daens-rp-filter-1078

Conversation

@Zhanfg

@Zhanfg Zhanfg commented Aug 15, 2026

Copy link
Copy Markdown

Background

Local IPv4 traffic proxied through dae can be dropped inside daens by Linux reverse-path filtering.

The host-side namespace already disables rp_filter, but daens has its own sysctl state. Linux reverse-path validation uses the stricter effective setting, so net.ipv4.conf.all.rp_filter and the dae0peer interface setting also need to be disabled inside the dae namespace.

This change applies both settings while DaeNetns is configuring the namespace, before the IPv4 datapath is used.

Checklist

Full Changelogs

  • Disable IPv4 reverse-path filtering for all and dae0peer inside daens.

Issue Reference

Closes #1078.

Test Result

  • git diff --check
  • Change is scoped to namespace sysctl initialization.
  • Upstream GitHub Actions are currently awaiting maintainer approval for fork-originated workflows.

@Zhanfg
Zhanfg requested a review from a team as a code owner August 15, 2026 16:30
Zhanfg added a commit to Zhanfg/dae that referenced this pull request Aug 15, 2026
@Zhanfg
Zhanfg requested a review from a team as a code owner August 15, 2026 17:07
@github-actions
github-actions Bot force-pushed the fix/daens-rp-filter-1078 branch from 1db0f3d to bea7d6b Compare August 15, 2026 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Local IPv4 proxied TCP connections are dropped by rp_filter on dae0peer (IP_RPFILTER)

1 participant