Repository navigation
F #-: VRouter: optional SNAT to the VIP or to a given address in NAT4 - #407
Closed
netaviator wants to merge 2 commits into
Closed
netaviator wants to merge 2 commits into
netaviator wants to merge 2 commits into
Conversation
NAT4 masquerades the traffic leaving through the selected NICs, so the outside address is the primary address of the NIC of the node that happens to forward it, and it changes with a failover. Add two opt-in ways to get a stable source address; with neither set the rules are unchanged. * ONEAPP_VNF_NAT4_SNAT_ADDRESS: SNAT every outgoing NIC to this address. For example a public address that is statically routed to the VIP: the address does not have to be configured on the router for the NAT to work (the replies come back through the route and are translated back), but to reach it from outside it can be added as an extra VIP (ONEAPP_VROUTER_ETH<n>_VIP<m>=<address>/32), which puts it on the VRRP master only. * ONEAPP_VNF_NAT4_SNAT_TO_VIP: for a NIC that has a VIP, SNAT to the first IPv4 VIP of the NIC in index order (the OpenNebula floating IP counts). IPv6 VIPs are ignored. The address wins over the VIP. The address ends up in a shell command, so anything but a plain dotted quad is rejected (a prefix length and surrounding spaces are stripped): the outgoing NICs then keep MASQUERADE, also when SNAT to the VIP is enabled, and the problem is logged with the attribute or the NIC (at most 40 characters of the value are logged). A NIC without a VIP keeps MASQUERADE. Checked with unit tests, and on a kernel with three network namespaces (client, router, server): with SNAT to an address the server sees the client as that address, with and without the address configured on the router, and the replies are translated back; with MASQUERADE it sees the NIC address of the router. Signed-off-by: Jan Gilla <jgilla@level66.network>
SNAT rewrote the VRRP advertisements the router sends itself to the NAT address, so both nodes appeared with the same source and kept the VIPs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NAT4 masquerades the traffic leaving through the selected NICs, so the outside address is the primary address of the NIC of the node that happens to forward it, and it changes with a failover. Add two opt-in ways to get a stable source address; with neither set the rules are unchanged.
The address wins over the VIP. The address ends up in a shell command, so anything but a plain dotted quad is rejected (a prefix length and surrounding spaces are stripped): the outgoing NICs then keep MASQUERADE, also when SNAT to the VIP is enabled, and the problem is logged with the attribute or the NIC (at most 40 characters of the value are logged). A NIC without a VIP keeps MASQUERADE.
Checked with unit tests, and on a kernel with three network namespaces (client, router, server): with SNAT to an address the server sees the client as that address, with and without the address configured on the router, and the replies are translated back; with MASQUERADE it sees the NIC address of the router.