openstack team mailing list archive
-
openstack team
-
Mailing list archive
-
Message #21041
Quantum floating IP SNAT not working
Hi,
I have a classic "Provider Network, private networks" as follows :
- internal network 10.0.0.0/24
- external network 192.168.10.0/24 gw 192.168.1.252 (I know, I have to
add a manual route on both gw and network node)
- br-ex is having 192.168.10.254
I have a floating IP 192.168.10.2 NAT'd to 10.0.0.4 and my external
router IP address is 192.168.10.1
For some reason, on br-ex, I see traffic from 10.0.0.4 to 192.168.1.154
(my own computer) with tcpdump :
19:55:58.938524 00:13:8f:51:96:9d > bc:ae:c5:d6:9d:60, ethertype IPv4
(0x0800), length 98: 10.0.0.4 > 192.168.1.154: ICMP echo request, id
62465, seq 1189, length 64
I should at least see a second ICMP request from 192.168.10.2 to
192.168.1.154 (with same seq. number) if L3 agent would work correctly.
DNAT is working correctly : I can ping from 192.168.1.154 to 192.168.10.2.
As a consequence, I can't access Internet from my VMs, but I can reach
them thru SSH.
Do you have any idea for the root cause ?
As said, the problem is bounded to a SNAT issue with Quantum L3 agent,
as DNAT is working perfectly.
Please find below my iproute2 status, my route configuration, plus
iptables -t nat.
sylvain@folsom02:~$ route -n
Table de routage IP du noyau
Destination Passerelle Genmask Indic Metric Ref Use Iface
0.0.0.0 192.168.1.252 0.0.0.0 UG 0 0 0 br-ex
0.0.0.0 172.16.0.2 0.0.0.0 UG 0 0 0 eth0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0
tap2ed3cd8a-03
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0
qr-f76e4668-fa
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
172.16.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0
192.168.1.252 0.0.0.0 255.255.255.255 UH 0 0 0 br-ex
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0
qg-f2397006-20
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 br-ex
sylvain@folsom02:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth2: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UP qlen 1000
link/ether 00:13:8f:51:96:9d brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UNKNOWN qlen 1000
link/ether 00:e0:7d:b5:df:ae brd ff:ff:ff:ff:ff:ff
inet 172.16.0.2/20 brd 172.16.15.255 scope global eth0
inet6 fe80::2e0:7dff:feb5:dfae/64 scope link
valid_lft forever preferred_lft forever
6: br-ex: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc
noqueue state UNKNOWN
link/ether 00:13:8f:51:96:9d brd ff:ff:ff:ff:ff:ff
inet 192.168.10.254/24 scope global br-ex
11: br-int: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether ca:0d:5d:80:15:49 brd ff:ff:ff:ff:ff:ff
12: qr-f76e4668-fa: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500
qdisc noqueue state UNKNOWN
link/ether fa:16:3e:4a:82:b6 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.1/24 brd 10.0.0.255 scope global qr-f76e4668-fa
inet6 fe80::f816:3eff:fe4a:82b6/64 scope link
valid_lft forever preferred_lft forever
13: qg-f2397006-20: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500
qdisc noqueue state UNKNOWN
link/ether fa:16:3e:e1:95:20 brd ff:ff:ff:ff:ff:ff
inet 192.168.10.1/24 brd 192.168.10.255 scope global qg-f2397006-20
inet 192.168.10.2/32 brd 192.168.10.2 scope global qg-f2397006-20
inet6 fe80::f816:3eff:fee1:9520/64 scope link
valid_lft forever preferred_lft forever
14: tap2ed3cd8a-03: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500
qdisc noqueue state UNKNOWN
link/ether fa:16:3e:8f:3c:92 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.2/24 brd 10.0.0.255 scope global tap2ed3cd8a-03
inet6 fe80::f816:3eff:fe8f:3c92/64 scope link
valid_lft forever preferred_lft forever
15: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN
link/ether 4e:46:e7:ec:52:49 brd ff:ff:ff:ff:ff:ff
sylvain@folsom02:~$ sudo iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
quantum-l3-agent-PREROUTING all -- 0.0.0.0/0 0.0.0.0/0
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
quantum-l3-agent-OUTPUT all -- 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
quantum-l3-agent-POSTROUTING all -- 0.0.0.0/0 0.0.0.0/0
quantum-postrouting-bottom all -- 0.0.0.0/0 0.0.0.0/0
Chain quantum-l3-agent-OUTPUT (1 references)
target prot opt source destination
DNAT all -- 0.0.0.0/0 192.168.10.2 to:10.0.0.4
Chain quantum-l3-agent-POSTROUTING (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ! ctstate DNAT
ACCEPT all -- 10.0.0.0/24 172.16.0.1
Chain quantum-l3-agent-PREROUTING (1 references)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 169.254.169.254 tcp dpt:80
to:172.16.0.1:8775
DNAT all -- 0.0.0.0/0 192.168.10.2 to:10.0.0.4
Chain quantum-l3-agent-float-snat (1 references)
target prot opt source destination
SNAT all -- 10.0.0.4 0.0.0.0/0 to:192.168.10.2
Chain quantum-l3-agent-snat (1 references)
target prot opt source destination
quantum-l3-agent-float-snat all -- 0.0.0.0/0 0.0.0.0/0
SNAT all -- 10.0.0.0/24 0.0.0.0/0 to:192.168.10.1
Chain quantum-postrouting-bottom (1 references)
target prot opt source destination
quantum-l3-agent-snat all -- 0.0.0.0/0 0.0.0.0/0
Thanks for your help,
-Sylvain
Follow ups
