From 104c2a06ae6e0f66a1ff0ef036743bd071d050fc Mon Sep 17 00:00:00 2001 From: Luke Faraone Date: Thu, 12 Dec 2013 16:15:19 -0500 Subject: [PATCH] Set iptables rules for each IP, not just each interface (imported from commit c24d2123489dc384bf50e379d245807af3488ebf) --- puppet/zulip_internal/files/zulip-ec2-configure-interfaces | 3 +++ 1 file changed, 3 insertions(+) diff --git a/puppet/zulip_internal/files/zulip-ec2-configure-interfaces b/puppet/zulip_internal/files/zulip-ec2-configure-interfaces index 8801ee536e..4f9f7e3218 100755 --- a/puppet/zulip_internal/files/zulip-ec2-configure-interfaces +++ b/puppet/zulip_internal/files/zulip-ec2-configure-interfaces @@ -91,6 +91,9 @@ for device in macs.values(): device = "eth%i:%i" % (device_number, count) log.info("Configuring %s with IP %s" % (device, ip)) subprocess.check_call(['/sbin/ifconfig', device, ip]) + subprocess.check_call( + ['/sbin/iptables', '-t', 'mangle', '-A', 'OUTPUT', '-m', 'conntrack', '--ctorigdst', + ip, '-j', 'MARK', '--set-mark', str(device_number)]) for throwaway in range(2): # Don't freak out if this doens't work.