Interesting case: after reboot. LXD no longer generates firewall rules. It seems to silently fail.
Ubuntu 20.04 LTS with latest LXD from snap.
UFW successfully starts and generates its default rules.
We have many fairly identical hosts that all work down to the UFW rules, so I suspect the cause is some incident on this specific host. But everything else about LXD working makes this very suspicious.
LXD log, LXD monitor, starting LXD in foreground with debug mode, syslog, systemd tools have come up with only one discrepancy from the other hosts. The failed host shows a warning about br_netfilter that other do not (it is not loaded on the others):
Jun 17 17:21:08 h2 lxd.daemon: t=2021-06-17T17:21:08+0000 lvl=warn msg="Proxy bridge netfilter not enabled: br_netfilter not loaded: open /proc/sys/net/bridge/bridge-nf-call-iptables: no such file or directory. Instances using the bridge will not be able to connect to the proxy's listen IP"
Adding the module to /etc/modules, updating initramfs and rebooting makes the warning go away but does not fix the issue.
Flipping ipv4/6.firewall on and off has no effect and does not produce any result, monitor shows:
location: none metadata: context: driver: bridge network: lxdbr0 project: default level: dbug message: Clearing firewall timestamp: "2021-06-17T18:48:20.437222175Z" type: logging location: none metadata: context: driver: bridge network: lxdbr0 project: default level: dbug message: Setting up firewall timestamp: "2021-06-17T18:48:21.127576861Z" type: logging
Disabling UFW and rebooting has no effect on LXD.
It seems as if LXD on this host simply and silently stopped interacting with iptables.
Any thoughts on where to look for more details or to debug this?