This assumes that every router is directly attached to the internet. This may be the case with home broadband routers and many public clouds but for just about every corporate network in the world there are several devices that do routing that are not directly attached to the internet. The requirement to turn off NAT by default would suit a lot of use cases in my opinion. NAT is generally not used with IPv6 at all. NAT for IPv4 has a place and that is at the edge of the network and we should not assume that a Neutron router namespace is necessarily the edge.
I’ve not experimented with OpenStack much yet but this is the sort of bizarre (or bizarre to me at least) assumption that also exists with CloudStack and is one of the reasons why I’m considering abandoning it in favour of OpenStack. Can anyone offer any knowledge on this front? Am I about to face the same problem with OpenStack? *From:* George Mihaiescu [mailto:lmihaie...@gmail.com] *Sent:* 18 May 2015 11:39 *To:* Simone Spinelli *Cc:* openstack@lists.openstack.org *Subject:* Re: [Openstack] disable source nat by default Couldn't you achieve the same goal with egress security rules? Without SNAT enabled, those instances wouldn't be able to reach the Internet at all, so no package updates, etc. On 18 May 2015 05:13, "Simone Spinelli" <simone.spine...@gmail.com> wrote: Hi all, by default neutron routers have source nat enabled and they masquerade using the external ip address: you can disable this function using API once the router is created. Is there a way to disable this function by default (I mean create routers with source nat disabled )? Any help is appreciated. Best regards Simone _______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack@lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
_______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack@lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
