Stateless Feature of Security Group Not Functioning in Case of other Port same compute use statefull

Hello Path:

I guess you are using ML2 Linux Bridge (with the iptables firewall). Please, provide the version of OpenStack used. If possible, provide a full dump of iptables, the ports used and the SG and rules description. The iptables version could be useful too.

If I'm not wrong, the problem here is that Line 34 and Line 53 are clashing. The first one is tracking the interface traffic in zone 4099 and the second one is marking this traffic a "no tracking". I guess this is a corner case not covered during the development nor the testing.

Let me remark that ML2/LB is in experimental support mode. That means it is no longer actively supported by the Neutron community. You could study moving to other mechanism drivers like ML2/OVS or ML2/OVN.

Regards.

Hello Rodolfo,
Your answer so helpful. This is my env:
    - Openstack Victory
    - Neutron: ML2 Linux Bridge
    - Deployer: Openstack Kolla
I uploaded my iptables-save to this post but just remind this dump isn't same the last one but the bug behavior is the same. BTW, I known linuxbridge is in experimental support mode but I see the code ML2 use for Linuxbridge and the OVS is shared codes sothat I hope I posted a helpful topic for both. Do you have any workaround for this case ?

This doesn't address your problem with ML2/LB, but FYI ML2/OVN stateless SG implementation addresses the problem by making sure that filters don't clash and that stateless ACLs are given priority.