[
https://issues.apache.org/jira/browse/CLOUDSTACK-10346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16443110#comment-16443110
]
ASF GitHub Bot commented on CLOUDSTACK-10346:
---------------------------------------------
rhtyd commented on issue #2514: [CLOUDSTACK-10346] Problem with NAT
configuration and VMs not accessing each other via public IPs
URL: https://github.com/apache/cloudstack/pull/2514#issuecomment-382510915
@rafaelweingartner okay let me try to explain what I understand (and btw
this is wrt 4.11, and may not apply for older ACS). The mangle table get rules
to mark some packets from PREROUTING (incoming packets), this is done by
configure.py mainly and you can get hint from CsRule.py. You can put routing
rules based on marked packets. For example, I see this in my VR:
```# ip rule
0: from all lookup local
32761: from all fwmark 0x3 lookup Table_eth3
32762: from all fwmark 0x2 lookup Table_eth2
32763: from all fwmark 0x1 lookup Table_eth1
```
By above, packets marked 0x will use routing table at `Table_eth1` which we
can list as:
```
# ip route show table Table_eth1
default via 192.168.1.1 dev eth1 proto static
throw 10.1.1.0/24 proto static
throw 10.1.2.0/24 proto static
throw 192.168.1.0/24 proto static
```
The issue at least for 4.11/master was that these routing table rules (throw
stuff may not be necessary, but the important is eth1 can do routing on VPC
tier cidrs). I added that, and tests confirm it works.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> Problem with NAT configuration and VMs not accessing each other via public IPs
> ------------------------------------------------------------------------------
>
> Key: CLOUDSTACK-10346
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10346
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Reporter: Rafael Weingärtner
> Assignee: Rafael Weingärtner
> Priority: Major
>
> When users create a VPC, and configure a NAT from a public IP to application
> in a VM. This VM(applications) are not accessible via public IP for other VMs
> in the same VPC.
>
> The problem is in the NAT table. If you take a closer look at rules, you will
> see something like:
> {code:java}
> -A PREROUTING -d publicIP/32 -i eth1 -p tcp -m tcp --dport 80 -j DNAT
> --to-destination internalIp:80
> {code}
> The problem is that according to this rule only packets coming via
> eth1(public interface), will be “redirected” to the internal IP. We need an
> extra entry to each one of the NAT configurations. For the presented rule, we
> would need something like:
> {code:java}
> -A PREROUTING -d publicIP/32 -i eth2 -p tcp -m tcp --dport 80 -j DNAT
> --to-destination internalIp:80
> {code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
