Routed subnets cannot use snat
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
In Progress
|
High
|
Alban PRATS |
Bug Description
Hi,
We have the following network configuration:
- Subnet A: 10.20.0.0/24
- Subnet B: 10.20.10.0/24
- Router Ext:
> With a external gateway
> linked to Subnet A (10.20.0.1)
> Route to 10.20.10.0/24 via 10.20.0.254
- Router Lan: Linked to both networks (10.20.0.254 and 10.20.10.1)
> linked to Subnet A (10.20.0.254)
> linked to Subnet B (10.20.10.1)
> Route to 0.0.0.0/0 via 10.20.0.1
While instances in the Subnet A can access Internet, instances in Subnet B cannot.
I got an error: From 10.20.0.1 icmp_seq=1 Destination Net Unreachable.
It looks like there is an ip rule in the namespace of the qrouter-RouterExt which route only requests from 10.20.0.1/24 through the Snat.
[root@host ns: qrouter-
10.20.0.0/24 dev qr-3a2a89c7-53 proto kernel scope link src 10.20.0.1
10.20.10.0/24 via 10.20.0.254 dev qr-3a2a89c7-53
169.254.110.154/31 dev rfp-e17d62be-d proto kernel scope link src 169.254.110.154
192.168.1.0/24 dev qr-0b3f2d0d-8b proto kernel scope link src 192.168.1.1
[root@host ns: qrouter-
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
169082881: from 10.20.0.1/24 lookup 169082881
[root@host ns: qrouter-
default via 10.20.0.173 dev qr-3a2a89c7-53
Is there a reason why we only route directly attached networks through the snat ?
I've come up with a fix that adds an ip rule for each network specified in the router's routes. Can you give me some feedback on this ? I'm mainly concerned about the reasons why this was this way in the first place and about the cleanup of the unused rules.
Best regards,
Changed in neutron: | |
importance: | Undecided → High |
Changed in neutron: | |
assignee: | nobody → Alban PRATS (al26p) |
tags: | added: l3-dvr-backlog |
Fix proposed to branch: master /review. opendev. org/c/openstack /neutron/ +/890459
Review: https:/