Reviewed: https://review.openstack.org/286392 Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=cea149212e6387932eaac8448c951d2ceb7ae23d Submitter: Jenkins Branch: master
commit cea149212e6387932eaac8448c951d2ceb7ae23d Author: Hong Hui Xiao <xiaoh...@cn.ibm.com> Date: Tue Mar 1 05:42:42 2016 +0000 Add fip nat rules even if router disables shared snat For legacy router, there are some iptables rules added for external gateway port. Some of these rules are for shared snat, some are for floating ip. When user disables shared snat of router gateway, some of the iptables rules that floating ip needs will not be added to router. This will cause the reported bug, ping floating ip but reply with fixed ip. The fix will add the iptables rules that floating ip needs, no matter if router enables shared snat. A functional test is also added for the issue. Change-Id: I3cf4dff90f47a720a2e6a92c9ede2bc067ebd6e7 Closes-Bug: #1551530 ** Changed in: neutron Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1551530 Title: With snat disabled legacy router Pings to floating IPs replied with fixed-ips Status in neutron: Fix Released Bug description: On my single node devstack setup, there are 2 VMs hosted. VM1 has no floating IP assigned. VM2 has a floating IP assigned. From VM1, ping to VM2 using the floating IP. Ping output reports the replies comes from VM2's fixed ip address. The reply should be from VM2's floating ip address. VM1: 10.0.0.4 VM2: 10.0.0.3 floating ip:172.24.4.4 $ ping 172.24.4.4 -c 1 -W 1 PING 172.24.4.4 (172.24.4.4): 56 data bytes 64 bytes from 10.0.0.3: seq=0 ttl=64 time=3.440 ms This will only happen for legacy router with snat disabled, and at the same time, VM1 and VM2 are in the same subnet. Compared the iptables, this following rule is missed when snat is disabled. Chain neutron-vpn-agen-snat (1 references) pkts bytes target prot opt in out source destination 1 84 SNAT all -- * * 0.0.0.0/0 0.0.0.0/0 mark match ! 0x2/0xffff ctstate DNAT to:172.24.4.6 This rule will SNAT internal traffic to floatingip. Without this rule, the packet of VM2 replying VM1 will be treated as a traffic inside subnet, and these traffic will not go through router. As a result, the DNAT record in router namespace will not work for reply packet. The intentional fix will add the mentioned iptables rule, no matter of snat enabling. So, the packet of VM2 replying VM1 will dest to <172.24.4.6>, and go through router namespace. As a result, the DNAT and SNAT record will work to make things right. To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1551530/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp