Comment 4 for bug 1470765

Revision history for this message
venkata anil (anil-venkata) wrote :

Details of the problem -

Steps to reproduce -
1) create 2 routers - r1 and r2
2) create a network n1 and with subnet sn1( CIDR 20.0.0.0/24 gateway-ip 20.0.0.100)
3) create a port 20.0.0.3 on n1 and add that to router r1( neutron router-interface-add r1 port=<port id of 20.0.0.3> )
4) add subnet sn1 to router r2 ( neutron router-interface-add r2 sn1)

Now sn1 is added to both routers r1 and r2.
r1 will have 20.0.0.3 as router interface port.
r2 will have 20.0.0.100 (subnet's gateway ip) as router interface port.

5) Connect both r1 and r2 to same external network.
6) Boot a vm on network n1.
7) create a floatingip on same external network for this vm.

Now this floatingip will be created on router r1(i.e router not having subnet's gateway-ip).

Problem -
When external public agent connects to vm through floatingip, he gets response with unexpected source ip.
 i.e details of packet flow process in this scenario

1) packets comes to r1 from external agent, dnat is done in r1, conntack connection established in r1
2) packet reaches vm from r1
3) vm sends reply packet to r2(because r2 is default gw in vm's routes)
4) r2 does snat and send's packet to external agent. r2 doesn't know floatingip of vm.
5) external agent receives pkt with source address of r2's external gateway interface ip and not floatingip
6) external agent may reject the response as response came from different ip