yahoo-eng-team team mailing list archive

[Launchpad Bug Tracker <1518296@xxxxxxxxxxxxxxxxxx>]

[Expired for neutron because there has been no activity for 60 days.]

** Changed in: neutron
       Status: Incomplete => Expired

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1518296

Title:
  Non snated packet should be blocked

Status in neutron:
  Expired

Bug description:
  Some deployments would like to use only floating ip to communicate
  with outside of tenant via external network.

  However, in current neutron, when running "neutron router-gateway-set"
  with specified router's "enable_snat" is false, then non-SNAT'ed
  packets can arrive at other tenant via external-network.  The packets
  don't pass through other tenant's gateway, but take extra load to
  external network.

  The packet should be NAT'ed when flowing on external network.  Non-
  SNAT'ed packets don't need to flow on external network.

  Therefore, non-SNAT'ed packets should be dropped at inside of own
  tenant.

  I will fix as follows:

    * The router is Legacy mode and enable_snat is True:
      No change from current implementation.

    * The router is Legacy mode and enable_snat is False:
      Add new rule for dropping outbound non-SNAT'ed packets.

    * The router is DVR mode and enable_snat is True:
      No change from current implementation.

    * The router is Legacy mode and enable_snat is False:
      Don't create SNAT name space.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1518296/+subscriptions