neutron/releasenotes/notes/iptables-fail-on-missing-sysctl-bridge-firewalling-912f157b5671363f.yaml
Ihar Hrachyshka 4a66fa833e Multiple tweaks for Ocata release notes
Those hopefully are of benefit. The major bit of the change is stopping
to use prelude section for all current release notes. This is because
the section is supposed to contain global release notes, not
feature-specific.

Other tweaks are open for debate.

Change-Id: I1d5e46591195a9756ee9fd5276f163794c366528
2017-01-15 01:46:21 +00:00

15 lines
757 B
YAML

---
deprecations:
- The ``iptables`` firewall driver will no longer enable bridge firewalling
in next versions of Neutron. If your distribution overrides the default
value for any of relevant sysctl settings
(``net.bridge.bridge-nf-call-arptables``,
``net.bridge.bridge-nf-call-ip6tables``, and
``net.bridge.bridge-nf-call-iptables``) then make sure you set them back
to upstream kernel default (``1``) using /etc/sysctl.conf or
/etc/sysctl.d/* configuration files.
upgrades:
- On newer Linux kernels (3.18+) you will need to load the ``br_netfilter``
kernel module before starting an Open vSwitch or Linuxbridge agent using
``iptables`` firewall driver. Otherwise the agent will fail to start.