resolves issues Multiple Public Subnets static NAT by havengit · Pull Request #4236 · apache/cloudstack

havengit · 2020-07-31T06:58:45Z

Description

This PR resolves 1 issues Multiple Public Subnets static NAT issue
#3361 VR Issues with Multiple Public Subnets
The network has Multiple Public Subnets, enable a static NAT for VM with public IP, If the public IP subnets is different to default SNAT public IP subnets , the VM SNAT IP is default SNAT IP.

For example
In isolate network
Public IP:
192.168.3.3 netmask 255.255.255.0 (default source NAT IP)
192.168.4.3 netmask 255.255.255.0
VM IP:
10.10.1.100

Enable static NAT for 192.168.4.3 -->10.10.1.100
In VM ,get the public IP with commond : curl ip.sb

incorrect:
source nat is 192.168.3.3
correct:
source nat is 192.168.4.3

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Screenshots (if appropriate):

How Has This Been Tested?

weizhouapache · 2020-08-02T19:46:41Z

as we have discussed, this issue is caused by commit 82d94a8

we need to find a way to fix both this issue and the issue described in #3604.
maybe add public device name in the rules ?

DaanHoogland · 2020-08-05T13:33:20Z

should we add
Fixes #4234
to the description of this PR, @havengit ?

DaanHoogland · 2020-08-11T08:07:49Z

kick travis in the

yadvr · 2020-08-14T07:27:41Z

@blueorangutan package

blueorangutan · 2020-08-14T07:28:56Z

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2020-08-14T08:25:47Z

Packaging result: ✔centos7 ✔debian. JID-1750

weizhouapache · 2020-08-14T08:49:57Z

as I said , this might cause the issue in #3604

yadvr · 2020-08-28T09:23:49Z

request for comments - @DaanHoogland @andrijapanicsb @PaulAngus

DaanHoogland · 2020-09-18T13:22:47Z

@weizhouapache this would re-introduce the second removed rule from #3604 , only on another location. What is the consequence of the MARK, in your opinion?

weizhouapache · 2020-09-22T15:48:17Z

 "-A PREROUTING -d %s/32 -m state --state NEW -j MARK --set-xmark %s/0xffffffff" %
 (rule["public_ip"], hex(100 + int(device[len("eth"):])))])
+ self.fw.append(["mangle", "front",
+ "-A PREROUTING -s %s/32 -m state --state NEW -i eth0 -j MARK --set-xmark %s/0xffffffff" %


@havengit @div8cn
I have tested this pr. The issue described in #3604 is not back.
However in this rule, it should not be "eth0".
for isolated network, the guest nic is eth0. but for vpc, eth0 is nic for link local ip.
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 0e:00:a9:fe:65:77 brd ff:ff:ff:ff:ff:ff inet 169.254.101.119/16 brd 169.254.255.255 scope global eth0 valid_lft forever preferred_lft forever
so in my point of view, this pr fixes the issue in isolated networks, but does not fix the issue in vpc. could you please confirm ? @havengit @div8cn
I have tested this pr but without "-i eth0", then issue #3604 is back.

ok, so we should be more intelligent about the IF to add in the rule, tnx @weizhouapache

@DaanHoogland I have confirmed with @div8cn that the issue still exist with vpc.

@DaanHoogland yes, This PR only fixes the issue in isolated networks , Weizhou's PR was much more effective #4484

DaanHoogland · 2020-10-20T11:42:09Z

@blueorangutan package

blueorangutan · 2020-10-20T11:42:56Z

@DaanHoogland a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2020-10-20T13:46:48Z

Packaging result: ✔centos7 ✔centos8 ✔debian. JID-2226

DaanHoogland · 2020-10-21T17:09:08Z

@blueorangutan test

blueorangutan · 2020-10-21T17:10:00Z

@DaanHoogland a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

blueorangutan · 2020-10-22T02:25:50Z

Trillian test result (tid-3041)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 31439 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr4236-t3041-kvm-centos7.zip
Smoke tests completed. 85 look OK, 0 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File

DaanHoogland · 2020-10-22T09:43:18Z

@weizhouapache @rhtyd @andrijapanicsb, lgtm lgt-you?

weizhouapache · 2020-10-22T12:13:12Z

@weizhouapache @rhtyd @andrijapanicsb, lgtm lgt-you?

@DaanHoogland
niet goed :-D
see #4236 (comment)

andrijapanicsb · 2020-10-22T15:19:14Z

see comment thread @DaanHoogland

DaanHoogland · 2020-10-22T18:38:31Z

@weizhouapache @rhtyd @andrijapanicsb, lgtm lgt-you?
@DaanHoogland
niet goed :-D
see #4236 (comment)

ok, @weizhouapache I didn't get it, just to verify, this solves it for isolated networks but we don't accept it because the issue remains for VPCs, right?
should we close this one?

weizhouapache · 2020-10-26T08:35:37Z

@weizhouapache @rhtyd @andrijapanicsb, lgtm lgt-you?
@DaanHoogland
niet goed :-D
see #4236 (comment)
ok, @weizhouapache I didn't get it, just to verify, this solves it for isolated networks but we don't accept it because the issue remains for VPCs, right?
@DaanHoogland yes, the issue still remains for VPCs.

should we close this one?
@DaanHoogland hmmmm...

DaanHoogland · 2020-10-26T13:13:31Z

should we close this one?
@DaanHoogland hmmmm...

i'll take that as a nee

DaanHoogland · 2020-11-16T08:39:21Z

@PaulAngus as per @weizhouapache 's comment, this has a 👎 . He is working on a more solid fix as far as I understand. If you want to RC this week, this should go to 4.15.1

yadvr · 2020-11-20T15:37:46Z

Looks like Wei has sent another PR that would handle some cases, @DaanHoogland @PaulAngus I'm not sure if this issue is handled well in Wei's new PR but given the objection let's move to next milestone?

havengit · 2020-11-23T06:26:39Z

Weizhou's PR was much more effective #4484

Update configure.py
1e8e989

havengit changed the title ~~Update configure.py~~resolves issues Multiple Public Subnets static NAT Jul 31, 2020

svenvogel added component:networking type:bug labels Jul 31, 2020

div8cn mentioned this pull request Aug 5, 2020
Static NAT with multiple public interfaces uses wrong outgoing IP #4234
Closed

DaanHoogland closed this Aug 11, 2020

DaanHoogland reopened this Aug 11, 2020

yadvr added this to the 4.15.0.0 milestone Aug 14, 2020

yadvr added component:virtual-router Severity:Major labels Aug 14, 2020

yadvr requested review from DaanHoogland, GabrielBrascher, weizhouapache and wido August 14, 2020 07:36

yadvr removed the Severity:Major label Aug 17, 2020

weizhouapache reviewed Sep 22, 2020
View reviewed changes

apache deleted a comment from blueorangutan Oct 21, 2020

DaanHoogland added the Severity:Critical Critical bug label Nov 10, 2020

DaanHoogland removed their request for review November 12, 2020 14:51

PaulAngus added the NEEDS-GO-NO_GO-URGENTLY label Nov 13, 2020

havengit closed this Nov 23, 2020

Uh oh!

Conversation

havengit commented Jul 31, 2020• edited by DaanHoogland Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

weizhouapache commented Aug 2, 2020

Uh oh!

DaanHoogland commented Aug 5, 2020

Uh oh!

DaanHoogland commented Aug 11, 2020

Uh oh!

yadvr commented Aug 14, 2020

Uh oh!

blueorangutan commented Aug 14, 2020

Uh oh!

blueorangutan commented Aug 14, 2020

Uh oh!

weizhouapache commented Aug 14, 2020

Uh oh!

yadvr commented Aug 28, 2020

Uh oh!

DaanHoogland commented Sep 18, 2020

Uh oh!

weizhouapacheSep 22, 2020

Choose a reason for hiding this comment

Uh oh!

DaanHooglandSep 23, 2020

Choose a reason for hiding this comment

Uh oh!

weizhouapacheOct 20, 2020

Choose a reason for hiding this comment

Uh oh!

havengitNov 23, 2020

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Oct 20, 2020

Uh oh!

blueorangutan commented Oct 20, 2020

Uh oh!

blueorangutan commented Oct 20, 2020

Uh oh!

DaanHoogland commented Oct 21, 2020

Uh oh!

blueorangutan commented Oct 21, 2020

Uh oh!

blueorangutan commented Oct 22, 2020

Uh oh!

DaanHoogland commented Oct 22, 2020

Uh oh!

weizhouapache commented Oct 22, 2020

Uh oh!

andrijapanicsb commented Oct 22, 2020

Uh oh!

DaanHoogland commented Oct 22, 2020

Uh oh!

weizhouapache commented Oct 26, 2020

Uh oh!

DaanHoogland commented Oct 26, 2020

Uh oh!

DaanHoogland commented Nov 16, 2020

Uh oh!

yadvr commented Nov 20, 2020

Uh oh!

havengit commented Nov 23, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

havengit commented Jul 31, 2020•
edited by DaanHoogland
Loading