[
https://issues.apache.org/jira/browse/CLOUDSTACK-10346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16520569#comment-16520569
]
ASF GitHub Bot commented on CLOUDSTACK-10346:
---------------------------------------------
izenk commented on issue #2514: [CLOUDSTACK-10346] Problem with NAT
configuration and VMs not accessing each other via public IPs
URL: https://github.com/apache/cloudstack/pull/2514#issuecomment-399504872
@rhtyd
Sorry for asking here, but can't understand if my situation is covered by
this fix or not.
Am I understand correctly, now in 4.11.0.0 we can have such situation:
vm1 -> vpc1 -> vr1:SNAT:public_ip (192.168.1.11)
vm2 -> vpc2 -> vr2:SNAT:public_ip (192.168.1.12)
Public network (192.168.0.0/16) gateway is 192.168.1.1
vr1 has rule for public network:
~~~
32763: from all fwmark 0x1 lookup Table_eth1
~~~
and rules for table are:
~~~
#ip route show table Table_eth1
default via 192.168.1.1 dev eth1 proto static
~~~
Such configuration means that vm2 can't connect to vm2 by
public_ip(192.168.1.11), because it tries to route public ip through gate
192.168.1.1, when it should not (because 1.11 and 1.12 are in the same network)
~~~
#ip route get 192.168.1.12 mark 0x1
192.168.1.12 via 192.168.1.1 dev eth1 table Table_eth1 src 192.168.1.11 mark
1
~~~
So, the result table should be:
~~~
#ip route show table Table_eth1
default via 192.168.1.1 dev eth1 proto static
192.168.0.0/16 dev eth1 scope link
~~~
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
> Problem with NAT configuration and VMs not accessing each other via public IPs
> ------------------------------------------------------------------------------
>
> Key: CLOUDSTACK-10346
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10346
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Reporter: Rafael Weingärtner
> Assignee: Rafael Weingärtner
> Priority: Major
>
> When users create a VPC, and configure a NAT from a public IP to application
> in a VM. This VM(applications) are not accessible via public IP for other VMs
> in the same VPC.
>
> The problem is in the NAT table. If you take a closer look at rules, you will
> see something like:
> {code:java}
> -A PREROUTING -d publicIP/32 -i eth1 -p tcp -m tcp --dport 80 -j DNAT
> --to-destination internalIp:80
> {code}
> The problem is that according to this rule only packets coming via
> eth1(public interface), will be “redirected” to the internal IP. We need an
> extra entry to each one of the NAT configurations. For the presented rule, we
> would need something like:
> {code:java}
> -A PREROUTING -d publicIP/32 -i eth2 -p tcp -m tcp --dport 80 -j DNAT
> --to-destination internalIp:80
> {code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
