Configuring MetalLB with as Load Balancer for Cloudstack

[braveadmin]

I have been trying to use MetalLB as Load Balancer for my CloudStack installation. However, I found that the IPs shared by MetalLB are being blocked by nftables rules.

Only when I modified the nftables and left only the minimum it started working:

nft list ruleset

table inet filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
                iifname "lo" accept
                ct state established,related accept
                ip protocol icmp accept
                tcp dport { 22, 1798, 5900-6100, 16514, 49152-49216 } accept
                tcp dport { 8080, 8250, 8443, 9090 } accept
                tcp dport { 111, 2049 } accept
                tcp dport 6443 accept
                tcp dport 80 accept
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
        }

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                meta pkttype multicast drop
        }
}
table bridge filter {
        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                ether daddr 01:80:c2:00:00:00 counter packets 0 bytes 0 drop
                ether daddr 01:00:0c:cc:cc:cd counter packets 0 bytes 0 drop
        }
}

These are the rules generated automatically by CloudStack:
rules.2.txt

Is there an easier way to configure MetalLB? If not, which rules should I add to the nftrules to allow IPs to be reached?

[weizhouapache]

@braveadmin
do you use advanced zone with security groups ?

[weizhouapache]

Does CloudStack support nftables usage?

unfornately no...

you may have noticed that the python script (security_group.py) uses iptables and iptables-save command in many lines

[braveadmin]

Hello all,

We have disabled nftables and we have resintalled cleaned all to use iptables/ebtables. After that we have the same behavior. We attach the iptables, ebtables and ipset configurations. Once we remove the iptables & ebtables created by CloudStack, MetalLB it works. Also, when it doesn't work, the arping -I cloudbr0 172.24.77.151
it doesn't work. We've checkt that this last command doesn't work due to ebtables.

Any suggestion?

Thanks

main-iptables.txt
main-ipset.txt
main-ebtables.txt

[weizhouapache]

We've checkt that this last command doesn't work due to ebtables.

there are some ebtables rules for anti-arp spoofing and anti-mac spoofing.
maybe that is the root cause

[braveadmin]

How can be these rules be managed from CloudStack?

[weizhouapache]

@braveadmin
you may refer to my comment in another ticket:
#10225 (comment)