neutron-l3-agent nat rules are setup but not effective on CentOS7.7

[Jon Masters]

There appears to be a netfilter nat bug in the CentOS7.7 kernel (3.10.0-1062.9.1.el7.x86_64) that prevents the nat rules from running for outbound qrouter DNAT (and presumably the inbound replies if they were to go out). It appears that the chains are correctly populated into the netns but they just never execute for the nat table. This smells similar to an earlier (but presumably fixed) RHEL/CentOS kernel bug that I found once I knew that this was the problem.

To reproduce: install a stock/updated CentOS7.7 x86 host with train k-a, provider network support, with the x86 host running the neutron containers. Instances spin up just fine and can ping internally but they have no outbound connectivity and cannot be pinged from floating IPs. The problem is that the floating IP is not getting routed correctly due to the above.

[Radosław Piliszek (yoctozepto)]

Is this reported upstream? To Red Hat or CentOS?

[Radosław Piliszek (yoctozepto)]

I am running 3.10.0-1062.1.1.el7.x86_64 and not seem to encounter this issue, so it might have been introduced between the two.

[Radosław Piliszek (yoctozepto)]

Does kernel downgrade help?

[Jon Masters (jcm)]

I didn’t report it to CentOS yet no

[Paul Peereboom (peereb)]

Hi Jon,
I've tested kernel-3.10.0-1062.9.1.el7.x86_64 on Rhel 7.7 and I could not reproduce the issue.

Tested on:
Openstack Rocky

Using ovs hybrid iptables firewall driver.

Are you using the ovs firewall driver or the hybrid driver?

Regards,
Paul

[Launchpad Janitor (janitor)]

[Expired for kolla-ansible because there has been no activity for 60 days.]