sdn traffic leaking out of the cluster
sdn traffic leaking out of the cluster

Customer has discovered that traffic sourced with ip from SDN subnet is
being sent out of the cluster non-masqueraded.

tcp --ctstate INVALID packets are escaping from the SDN
This change adds a FORWARD rule to DROP these packets.
filter chain
FORWARD -s n.clusterNetworkCIDR -m conntrack --ctstate INVALID -j DROP

bug 1438762
https://bugzilla.redhat.com/show_bug.cgi?id=1438762

sferich888/origin,gabemontero/origin,pravisankar/origin,ryanj/origin,legionus/origin,pravisankar/origin,ramr/origin,wjiangjay/origin,dinhxuanvu/origin,imcsk8/origin,mahak/origin,sg00dwin/origin,sferich888/origin,pravisankar/origin,juanvallejo/origin,jwhonce/origin,louyihua/origin,rajatchopra/origin,kargakis/origin,wanghaoran1988/origin,PI-Victor/origin,dgoodwin/origin,matthyx/origin,wanghaoran1988/origin,chlunde/origin,aveshagarwal/origin,akram/origin,dcbw/origin,rhamilto/origin,rhamilto/origin,pmorie/origin,php-coder/origin,anpingli/origin,dobbymoodge/origin,hferentschik/origin,csrwng/origin,ironcladlou/origin,imcsk8/origin,adelton/origin,jsafrane/origin,juanvallejo/origin,dobbymoodge/origin,maxamillion/origin,luciddreamz/origin,sjug/origin,dgoodwin/origin,linzhaoming/origin,wjiangjay/origin,mrogers950/origin,php-coder/origin,rootfs/origin,anpingli/origin,PI-Victor/origin,mdshuai/origin,miminar/origin,detiber/origin,dgoodwin/origin,ryanj/origin,markllama/origin,JacobTanenbaum/origin,markllama/origin,deads2k/origin,goern/origin,childsb/origin,tnozicka/origin,abutcher/origin,jwhonce/origin,miminar/origin,matthyx/origin,liggitt/origin,detiber/origin,ryanj/origin,ryanj/origin,nhr/origin,legionus/origin,akram/origin,pmorie/origin,dgoodwin/origin,liggitt/origin,mrogers950/origin,maxamillion/origin,elyscape/origin,rhamilto/origin,linzhaoming/origin,nak3/origin,rootfs/origin,mdshuai/origin,dinhxuanvu/origin,aveshagarwal/origin,legionus/origin,JacobTanenbaum/origin,mdshuai/origin,miminar/origin,jim-minter/origin,sg00dwin/origin,luciddreamz/origin,ramr/origin,chlunde/origin,chlunde/origin,jeremyeder/origin,aveshagarwal/origin,jupierce/origin,mfojtik/origin,xiuwang/origin,imcsk8/origin,chlunde/origin,pmorie/origin,PI-Victor/origin,wjiangjay/origin,liggitt/origin,coreydaley/origin,sallyom/origin,juanvallejo/origin,PI-Victor/origin,detiber/origin,ravisantoshgudimetla/origin,maxamillion/origin,coreydaley/origin,ramr/origin,ingvagabund/origin,hroyrh/origin,akram/origin,ingvagabund/origin,louyihua/origin,louyihua/origin,mkumatag/origin,spadgett/origin,elyscape/origin,mdshuai/origin,jeremyeder/origin,wjiangjay/origin,rootfs/origin,jupierce/origin,sallyom/origin,rajatchopra/origin,liangxia/origin,ryanj/origin,liggitt/origin,markllama/origin,anpingli/origin,nhr/origin,Miciah/origin,simo5/origin,php-coder/origin,mdshuai/origin,jwhonce/origin,spadgett/origin,matthyx/origin,dinhxuanvu/origin,jupierce/origin,juanvallejo/origin,mrogers950/origin,mrogers950/origin,markllama/origin,childsb/origin,sjug/origin,bparees/origin,goern/origin,jwhonce/origin,sdminonne/origin,bparees/origin,smarterclayton/origin,adelton/origin,matthyx/origin,nak3/origin,pmorie/origin,Miciah/origin,jeremyeder/origin,jeremyeder/origin,php-coder/origin,pravisankar/origin,mahak/origin,markllama/origin,kargakis/origin,rrati/origin,elyscape/origin,pweil-/origin,miminar/origin,louyihua/origin,ramr/origin,jsafrane/origin,kargakis/origin,rhcarvalho/origin,kargakis/origin,abutcher/origin,hroyrh/origin,abutcher/origin,soltysh/origin,Miciah/origin,elyscape/origin,nhr/origin,raffaelespazzoli/origin,luciddreamz/origin,enj/origin,danmcp/origin,juanvallejo/origin,hferentschik/origin,sg00dwin/origin,nhr/origin,jwhonce/origin,wjiangjay/origin,rajatchopra/origin,tnozicka/origin,adelton/origin,pecameron/origin,dinhxuanvu/origin,mrogers950/origin,mkumatag/origin,liggitt/origin,luciddreamz/origin,dcbw/origin,dobbymoodge/origin,smarterclayton/origin,gabemontero/origin,pravisankar/origin,hferentschik/origin,linzhaoming/origin,kargakis/origin,childsb/origin,childsb/origin,rhcarvalho/origin,ironcladlou/origin,raffaelespazzoli/origin,maxamillion/origin,liangxia/origin,hroyrh/origin,tnozicka/origin,miminar/origin,dinhxuanvu/origin,hferentschik/origin,linzhaoming/origin,nak3/origin,rhcarvalho/origin,jwhonce/origin,raffaelespazzoli/origin,detiber/origin,rrati/origin,jim-minter/origin,kargakis/origin,sjug/origin,pecameron/origin,linzhaoming/origin,dobbymoodge/origin,deads2k/origin,abutcher/origin,imcsk8/origin,liangxia/origin,ryanj/origin,detiber/origin,gabemontero/origin,mahak/origin,rrati/origin,rajatchopra/origin,liangxia/origin,dgoodwin/origin,smarterclayton/origin,danmcp/origin,jim-minter/origin,tnozicka/origin,sg00dwin/origin,tnozicka/origin,legionus/origin,ravisantoshgudimetla/origin,jupierce/origin,hferentschik/origin,enj/origin,csrwng/origin,PI-Victor/origin,bparees/origin,smarterclayton/origin,imcsk8/origin,soltysh/origin,simo5/origin,spadgett/origin,PI-Victor/origin,danmcp/origin,mdshuai/origin,sdminonne/origin,miminar/origin,JacobTanenbaum/origin,childsb/origin,luciddreamz/origin,danmcp/origin,wanghaoran1988/origin,pweil-/origin,ramr/origin,luciddreamz/origin,dobbymoodge/origin,csrwng/origin,adelton/origin,mkumatag/origin,openshift/origin,rhamilto/origin,juanvallejo/origin,sallyom/origin,xiuwang/origin,ravisantoshgudimetla/origin,jpeeler/origin,spadgett/origin,markllama/origin,hferentschik/origin,ravisantoshgudimetla/origin,php-coder/origin,raffaelespazzoli/origin,dcbw/origin,dobbymoodge/origin,liangxia/origin,abutcher/origin,pecameron/origin,xiuwang/origin,openshift/origin,adelton/origin,jpeeler/origin,simo5/origin,rajatchopra/origin,openshift/origin,rootfs/origin,louyihua/origin,php-coder/origin,coreydaley/origin,legionus/origin,rhamilto/origin,rrati/origin,jpeeler/origin,sdminonne/origin,matthyx/origin,pweil-/origin,jupierce/origin,wanghaoran1988/origin,enj/origin,rootfs/origin,ironcladlou/origin,jeremyeder/origin,liangxia/origin,deads2k/origin,imcsk8/origin,ingvagabund/origin,soltysh/origin,rhcarvalho/origin,goern/origin,rrati/origin,spadgett/origin,mfojtik/origin,sferich888/origin,mfojtik/origin,childsb/origin,liggitt/origin,wjiangjay/origin,aveshagarwal/origin,rhcarvalho/origin,simo5/origin,jpeeler/origin,pmorie/origin,dcbw/origin,rajatchopra/origin,ravisantoshgudimetla/origin,aveshagarwal/origin,smarterclayton/origin,mrogers950/origin,maxamillion/origin,wanghaoran1988/origin,elyscape/origin,dcbw/origin,nhr/origin,jpeeler/origin,simo5/origin,goern/origin,jsafrane/origin,tnozicka/origin