[fwaas]Support fwaas to control east-west traffic in dvr router

[lee jian]

when fwaas is enabled with dvr router, the firewall rules will only be added to snat-ROUTER_ID on controller and floating ip namespaces on compute, this will result that, only south-north traffic can be controlled by fwaas, and the east-west traffic,which produced from one subnet to another is out of fwaas' control.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/203493

[OpenStack Infra (hudson-openstack)]

Change abandoned by Jian LI (<email address hidden>) on branch: master
Review: https://review.openstack.org/203493
Reason: Not a good solution and needed more discussion to fix it.

[Miguel Lavalle (minsel)]

swami, mickey and sridhar working on a fix proposal

[Swaminathan Vasudevan (swaminathan-vasudevan)]

Based on the direction the FWaaS is taking on applying the firewall rules to the VM port, there might not be any change required for DVR, except for some documentation on advocating not to apply the firewall rules for the router ports in the case of DVR.

[Armando Migliaccio (armando-migliaccio)]

I'd say that DVR should be a requirement being tracked here:

https://review.openstack.org/#/c/237687/5/specs/mitaka/approved/libvirt-vif-vhostuser-fp.rst

To this aim, this RFE is most likely to be superseded.

[Armando Migliaccio (armando-migliaccio)]

I'd say that DVR should be a requirement being tracked here:

https://review.openstack.org/#/c/243873/

To this aim, this RFE is most likely to be superseded.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]