From 26c6716cbf7078167d4bfe1cab5266f66f9351e2 Mon Sep 17 00:00:00 2001
From: masco <mkaliyam@redhat.com>
Date: Thu, 16 Jul 2026 15:12:53 +0530
Subject: [PATCH] fix worker node external conectivity

---
 ansible/roles/bootstrap/tasks/main.yml   | 25 ++++++++++++++++++++++++
 ansible/roles/values-prep/tasks/main.yml |  4 ----
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/ansible/roles/bootstrap/tasks/main.yml b/ansible/roles/bootstrap/tasks/main.yml
index 954fc17..2d62dd1 100644
--- a/ansible/roles/bootstrap/tasks/main.yml
+++ b/ansible/roles/bootstrap/tasks/main.yml
@@ -4,6 +4,18 @@
   become: yes
   ignore_errors: yes
 
+- name: Remove default REJECT rules from iptables
+  block:
+    - name: Remove INPUT REJECT rule
+      command: iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited
+      become: yes
+      ignore_errors: yes
+
+    - name: Remove FORWARD REJECT rule
+      command: iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited
+      become: yes
+      ignore_errors: yes
+
 - name: clean up the dt_path
   file:
     path: "{{ dt_path }}"
@@ -31,6 +43,19 @@
   shell: |
     oc patch network.operator cluster -p '{"spec":{"defaultNetwork": {"ovnKubernetesConfig":{"gatewayConfig":{"ipForwarding": "Global"}}}}}' --type=merge
 
+- name: Configure NAT masquerade on public interface
+  block:
+    - name: get default route
+      shell: |
+        ip r | grep default | cut -d ' ' -f5
+      register: default_route
+      become: yes
+
+    - name: masquerade on public interface
+      shell: |
+        iptables -t nat -A POSTROUTING -o {{ default_route.stdout }} -j MASQUERADE
+      become: yes
+
 - name: Setup observability operator
   block:
     - name: Copy observability operator subscription template
diff --git a/ansible/roles/values-prep/tasks/main.yml b/ansible/roles/values-prep/tasks/main.yml
index 4e91e54..ff24234 100644
--- a/ansible/roles/values-prep/tasks/main.yml
+++ b/ansible/roles/values-prep/tasks/main.yml
@@ -47,10 +47,6 @@
   become: yes
   ignore_errors: yes
 
-- name: set masquerade for the jump host
-  shell: |
-    iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o {{ iface_0 }} -j MASQUERADE
-
 - name: get the common disk accros nodes
   include_tasks: find-node-disks.yml