** Changed in: neutron
Status: Fix Committed => Fix Released
** Changed in: neutron
Milestone: None => liberty-rc1
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1483315
Title:
ebtables ARP rules don't account for floating IPs on LinuxBridge
Status in neutron:
Fix Released
Bug description:
The new ebtables ARP filtering rules don't account for floating IPs,
which blocks ARP replies from the qrouter netns the float lives in,
effectively blocking traffic to the float and thus the instance.
Looking at the ebtables code, rules are currently only added for ports
with port security enabled (port_filter:True), IPs in the fixed_ips
list and IPs in the allowed-address pairs list for a given port.
Floating IPs do not have port security enabled, aren't fixed_ips and
aren't automatically inserted into router gateway port AAPs.
This is an example ebtables -L --Lc list of the filter table on the root
namespace where the router is:
http://paste.openstack.org/show/412384/
192.168.74.0/24 is the private instance network
172.29.248.0/22 is the public network
192.168.74.1 is the router inside IP
192.168.74.2 is the DHCP server IP
192.168.74.3 is the instance IP
172.29.248.2 is the router gateway/outside IP
172.29.248.3 is the DHCP server IP (forgot to disable for the public)
172.29.248.8 is the floating IP
As you can see, the floating IP is not in the rules, which results in
ARP replies from the qrouter namespace being dropped.
Adding the exception to ebtables results in working traffic, like this (line
18):
http://paste.openstack.org/show/412386/
For reference, here's ebtables from the compute node along with the instance
information:
http://paste.openstack.org/show/412387/
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1483315/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
