weizhouapache commented on PR #9552: URL: https://github.com/apache/cloudstack/pull/9552#issuecomment-2298416555
@DaanHoogland I had a look at issue https://github.com/apache/cloudstack/issues/8562 which has been fixed by #8599 Assume there are two public IPs in the VPC VR (and isolated network VR): - xx.xx.64.x (source nat, default public IP), on eth1 - xx.xx.96.x (additional public ip range). on ethX I think the expected behaviour should be - all vms (without Static Nat) has the source Ip xx.xx.64.x (this is current behaviour) - the VR should be able to connect to xx.xx.96.x network with source ip xx.xx.96.x (otherwise the gateway check may fail, see #9473) - the VMs should be able to connect to xx.xx.96.x network with source ip xx.xx.64.x or xx.xx.96.x (to be discussed) currently the rules are ``` -A POSTROUTING -j SNAT -o eth1 --to-source xx.xx.64.x -A POSTROUTING -j SNAT -o ethX --to-source xx.xx.64.x ``` seems better to change to ``` -A POSTROUTING -j SNAT -o eth1 --to-source xx.xx.64.x -A POSTROUTING -j SNAT -o ethX --to-source xx.xx.96.x ``` or ``` -A POSTROUTING -j SNAT -o eth1 --to-source xx.xx.64.x -A POSTROUTING -j SNAT -o ethX -d xx.xx.96.1 --to-source xx.xx.96.x (96.1 is gateway) -A POSTROUTING -j SNAT -o ethX ! -d xx.xx.96.1 --to-source xx.xx.64.x (96.1 is gateway) ``` to be discussed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
