SNAT for externally routed traffic should be only for EC2 and for subnets in the VPC

[James Tunnicliffe]

In worker/provisioner/lxc-broker.go we have code that adds iptables rules. One rule is required at the moment for EC2 - all traffic flowing out of the VPC must look like it came from a physical interface. We don't want to apply this to traffic that has a destination inside the VPC. At the moment we have a simple hostIP/16 match to avoid mangling internal traffic, but this should be specific to EC2 (currently it is applied to all providers when deploying an LXC machine) and should be only for subnets inside the VPC.

[Dimiter Naydenov (dimitern)]

I'm retriaging this for post 1.24-alpha1, as the fix we had in place for 1.23 will still work on AWS (hardcoding the /16 VPC super-range which is true for all default VPCs in AWS, in the SNAT rule), but can be improved (explicitly listing each VPC's subnet CIDRs in separate SNAT rules).

[Dimiter Naydenov (dimitern)]

The proper way to fix this is to have a state policy so it's up to the provider to decide whether NAT is needed for containers or not (as discussed with William).

[Dimiter Naydenov (dimitern)]

This PR https://github.com/juju/juju/pull/2190 did not land in time, so the described behavior for 1.24 and 1.25 is not in place and MAAS is still broken when the address-allocation feature flag is enabled. I'll include the changes from #2190 into a PR which forward ports of the fix for bug 1442257. Once it lands, the described behavior (using a state policy instead of the provider type to determine whether to enable NAT, as well as listing all subnets CIDRs in a the default VPC explicitly as separate SNAT rules) still needs improvement. James, please ping me if something is not clear.

[Cheryl Jennings (cherylj)]

@dimitern, @dooferlad - It's unclear if this is still an issue. It sounds like this may have been fixed in PR: https://github.com/juju/juju/pull/2392 , but it's not clear from the commit message?

[Dimiter Naydenov (dimitern)]

No longer an issue since the legacy AC code is removed in 2.0.