multiple routers per subent cause a wrong placement of floating ips

[Marcel Jordan]

in a subnet with more than one router the floating-ip dnat-rule is assigend to the router, which port is the first router-port in the subnet-portlist whether it is the default gateway or not.

[Assaf Muller (amuller)]

Is this with normal routers? DVR?

[Marcel Jordan (mortzel)]

This is with normal routers.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]

[venkata anil (anil-venkata)]

Details of the problem -

Steps to reproduce -
1) create 2 routers - r1 and r2
2) create a network n1 and with subnet sn1( CIDR 20.0.0.0/24 gateway-ip 20.0.0.100)
3) create a port 20.0.0.3 on n1 and add that to router r1( neutron router-interface-add r1 port=<port id of 20.0.0.3> )
4) add subnet sn1 to router r2 ( neutron router-interface-add r2 sn1)

Now sn1 is added to both routers r1 and r2.
r1 will have 20.0.0.3 as router interface port.
r2 will have 20.0.0.100 (subnet's gateway ip) as router interface port.

5) Connect both r1 and r2 to same external network.
6) Boot a vm on network n1.
7) create a floatingip on same external network for this vm.

Now this floatingip will be created on router r1(i.e router not having subnet's gateway-ip).

Problem -
When external public agent connects to vm through floatingip, he gets response with unexpected source ip.
 i.e details of packet flow process in this scenario

1) packets comes to r1 from external agent, dnat is done in r1, conntack connection established in r1
2) packet reaches vm from r1
3) vm sends reply packet to r2(because r2 is default gw in vm's routes)
4) r2 does snat and send's packet to external agent. r2 doesn't know floatingip of vm.
5) external agent receives pkt with source address of r2's external gateway interface ip and not floatingip
6) external agent may reject the response as response came from different ip

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/220135

[Kyle Mestery (mestery)]

Moving to Mitaka-1, we can back port to Liberty once it releases.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/220135
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=526d28c5dba75e517bf833b895b69b840f03c6a4
Submitter: Jenkins
Branch: master

commit 526d28c5dba75e517bf833b895b69b840f03c6a4
Author: venkata anil <email address hidden>
Date: Thu Sep 3 13:07:44 2015 +0000

    select router with subnet's gateway_ip for floatingip

    1) when a subnet is connected to multiple routers and
    all these routers are connected to same external network,
    then select the router with subnet's gateway_ip, if available,
    for managing floatingip.

    2) Otherwise go with default existing behavior i.e
    select first router in internal subnet, that also present on external network.

    For scenario 1), if the router with gateway ip not selected,
    then for connections initiated by external agent towards floatingip
    won't get response with floatingip as source address,
    instead gw ip of router(i.e router with subnet's gateway_ip) as source.
    Details about the bug at [1]

    [1] https://bugs.launchpad.net/neutron/+bug/1470765/comments/4

    Closes-bug: #1470765
    Change-Id: If054945eab058c7138aabbb22cda15890ccb502c

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/341814

[OpenStack Infra (hudson-openstack)]

Change abandoned by Fei Long Wang (<email address hidden>) on branch: stable/liberty
Review: https://review.openstack.org/341814