I managed to get a small POC working with devstack and OVN 26.03.3 built
from source.
with ovn_router_indirect_snat=True, neutron will indeed create a single
NAT rule for 0.0.0.0/0 instead of individual ones for each attached
network.
stack@devstack:~/devstack$ sudo ovn-nbctl list nat
_uuid : 6cec0d47-3f81-4daf-b228-d611899903d3
allowed_ext_ips : []
exempted_ext_ips : []
external_ids : {}
external_ip : "172.24.4.49"
external_mac : []
external_port_range : ""
gateway_port : []
logical_ip : "0.0.0.0/0"
logical_port : []
match : ""
options : {}
priority : 0
type : snat
As assumed we can use the `match` option introduced in OVN 24.9 to exclude
CIDRs from NAT:
sudo ovn-nbctl set nat 6cec0d47-3f81-4daf-b228-d611899903d3
match='"ip4.src != 10.0.0.0/26"'
This causes traffic on the external network to originate from the VM's
source ip, not the router.
The ovn_router_indirect_snat=True behaviour has become the default on 2026.2.
We are still on 2025.1 with ovn_router_indirect_snat=False, but I don't think
it makes sense to implement address_scope support for this configuration,
considering it is already planned for removal [1].
[1] https://docs.openstack.org/releasenotes/neutron/2026.2.html
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1924776
Title:
[ovn] use of address scopes does not automatically disable router snat
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1924776/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
