On 7/19/18 7:52 PM, D'Souza, Nelson wrote:
> Hi,
>
>
>
> I'm seeing a VRF/Netfilter related issue on a system running a 4.14.52
> Linux kernel.
>
>
>
> I have an eth interface enslaved to l3mdev mgmtvrf device.
>
>
>
> After reviewing
> https://netdevconf.org/1.2/papers/ahern-what-is-l3mdev-paper.pdf, I was
> expecting that the Netfilter NF_INET_PRE_ROUTING rules would be applied
> to packets at the ingress eth interface and VRF device level. I
> confirmed that this works for pre-routing rules added to the raw and
> mangle tables at the ingress interface and VRF device level. I'm having
> issues though with pre-routing rules that are applied to the NAT table.
> NAT pre-routing rules only match on the ingress eth interface, not on
> the mgmtVRF device. As a result, I'm not able to apply DNAT at the
> mgmtvrf device level for IPv4 packets sourced from an external host and
> destined to the eth interface ip address.
>
>
>
> Also observed that a tcpdump on the mgmtvrf device captures packets
> ingressing on the mgmtvrf.
>
>
>
> Please let me know if my understanding is correct, and if so, if this is
> a resolved/outstanding issue.
>
I am puzzled by this one. My main dev server uses mgmt vrf with DNAT
rules to access VMs running on it, so I know it works to some degree. e.g.,
$ sudo iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 409 packets, 68587 bytes)
pkts bytes target prot opt in out source
destination
8761 583K ACCEPT all -- br0 * 0.0.0.0/0
0.0.0.0/0
5 320 DNAT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:2201 to:10.1.1.1:22
...
But, adding LOG rule does not show a hit with dev == mgmt.
