So, not use explicitly_egress_direct=True, you have to face these issues.
Another thing is that as I said in the release note before, do not use ``explicitly_egress_direct=True`` in host which enable dvr_snat and compute service. There are too many cases need to cover, please try to combine the following cases for DVR:
1. vlan/vxlan
2. dvr/dvr+ha
3. agent mode(dvr, dvr_snat, dvr_no_external)
4. east-west traffic and north-south traffic with the Scenario of src and dest in or not in same host
5. IPv6
6. allowed_address_pair
7. enable/disabl openflow firewall
8. HA router failover
The final cases is too many to cover.
The patch of https:/ /review. opendev. org/c/openstack /neutron/ +/666991 which introduced the config option ``explicitly_ egress_ direct= True/False` ` had fixed the following problems: openflow) security group driver /bugs.launchpad .net/neutron/ +bug/1732067
1. the egress flooding issue on br-int when enable openvswitch(
https:/
2. fix the east-west traffic broken of dvr /bugs.launchpad .net/neutron/ +bug/1831534 (this bug is for VLAN network, but the issue is not vlan only).
https:/
3. fix some potential ingress flood issue on br-int
And I had put some issues here as well: /bugs.launchpad .net/neutron/ +bug/1934666/ comments/ 5
https:/
So, not use explicitly_ egress_ direct= True, you have to face these issues.
Another thing is that as I said in the release note before, do not use ``explicitly_ egress_ direct= True`` in host which enable dvr_snat and compute service. There are too many cases need to cover, please try to combine the following cases for DVR: address_ pair
1. vlan/vxlan
2. dvr/dvr+ha
3. agent mode(dvr, dvr_snat, dvr_no_external)
4. east-west traffic and north-south traffic with the Scenario of src and dest in or not in same host
5. IPv6
6. allowed_
7. enable/disabl openflow firewall
8. HA router failover
The final cases is too many to cover.
And FYI, we had mark that dvr_snat + compute services is not supported. /review. opendev. org/c/openstack /neutron/ +/801503
https:/