waterWang opened a new pull request, #13943: URL: https://github.com/apache/cloudstack/pull/13943
### Problem On a VPC with public IPs from more than one range/VLAN, the virtual router installs an unscoped source NAT rule on every public interface using the single VPC source NAT address. Because the rule has no source match (`-s`), it also rewrites traffic the router itself originates, so the VR cannot emit packets with the correct source address from any public interface other than the source-NAT one. ### Fix Add `-m addrtype ! --src-type LOCAL` to the `elif` SNAT rule generated in `CsAddress.py`. This excludes packets whose source is an address on the router, while forwarded (guest) traffic still matches and is SNATed as before. ### Verification The reporter verified the fix manually on the VR: ``` iptables -t nat -D POSTROUTING -o eth2 -j SNAT --to-source 10.1.30.5 iptables -t nat -A POSTROUTING -o eth2 -m addrtype ! --src-type LOCAL -j SNAT --to-source 10.1.30.5 ``` Closes: #13942 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
