Can't dnat from 169.254.169.254:80 to host:8775

[Xiang Hui]

After setting "enable_metadata_proxy=False" on /etc/neutron/l3_agent.ini, which means shut down the
neutron-ns-metadata-proxy, and choose to use nova metadata, but there still have a rule as below:

iptables -t nat -D neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697

which will block the rules

iptables -t nat -A PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination $HOST:8775

I think this is a bug, it should be fixed in the code, if not enable neutron metadata , then don't add the first rule.
Thanks advance for any advice.

[Xiang Hui (xianghui)]

Hi Mark,
  Are you going to fix it? : )
Thanks.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/45559

[Jian Wen (wenjianhn)]

Maybe it's worth filing a new bug to remove the metadata filter rules as well.

[Xiang Hui (xianghui)]

@Jian Wen, sorry, I didn't get it, are you going to say l3 agent didn't remove this metadata filter rules after user disable the metadata proxy? if so, that's a good point.

Thanks.

[Xiang Hui (xianghui)]

@Jian Wen, I got your point , the metadata filter rules should be treated as metadata nat rules.
Great Thanks.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/45559
Committed: http://github.com/openstack/neutron/commit/84d73ec5999339919c937687c81de77732886bd4
Submitter: Jenkins
Branch: master

commit 84d73ec5999339919c937687c81de77732886bd4
Author: Hui HX Xiang <email address hidden>
Date: Sat Sep 7 19:51:42 2013 -0700

    Don't add neutron metadata_nat_rules if disable metadata proxy

    This patchset fixes this issue by adding a condition when adding nat
    rules of neutron metadata proxy.

    fixes bug #1212168

    Change-Id: I99775aad73c49a8df3043690440d214614279a2b