[RFE] Add TCP/UDP port forwarding extension to L3

Bug #1491317 reported by Gal Sagie on 2015-09-02
This bug affects 7 people
Affects Status Importance Assigned to Milestone

Bug Description

I have searched and found many past efforts to implement port forwarding
in Neutron. I have found two incomplete blueprints [1], [2] and an
abandoned patch [3].

There is even a project in Stackforge [4], [5] that claims to implement
this, but the L3 parts in it seems older then current master.

I have recently came across this requirement for various use cases, one
of them is providing feature compliance with Docker port-mapping feature
(for Kuryr), and saving floating IP's space.

There has been many discussions in the past that require this feature,
so i assume there is a demand to make this formal, just a small examples
[6], [7], [8], [9]

The idea in a nutshell is to support port forwarding (TCP/UDP ports) on
the external router leg from the public network to internal ports, so
user can use one Floating IP (the external gateway router interface IP)
and reach different internal ports depending on the port numbers. This
should happen on the network node (and can also be leveraged for
security reasons).

I think that the POC implementation in the Stackforge project shows that
this needs to be implemented inside the L3 parts of the current
reference implementation, it will be hard to maintain something like
that in an external repository. (I also think that the API/DB
extensions should be close to the current L3 reference implementation)

I would like to renew the efforts on this feature and propose a spec for
this to the next release. And of course if any of the people interested
or any of the people that worked on this before want to join the effort,
you are more then welcome to join and comment.

[1] https://blueprints.launchpad.net/neutron/+spec/router-port-forwarding
[2] https://blueprints.launchpad.net/neutron/+spec/fip-portforwarding
[3] https://review.openstack.org/#/c/60512/
[4] https://github.com/stackforge/networking-portforwarding
[5] https://review.openstack.org/#/q/port+forwarding,n,z
[6] https://ask.openstack.org/en/question/75190/neutron-port-forwarding-qrouter-vms/
[7] http://www.gossamer-threads.com/lists/openstack/dev/34307
[8] http://openstack.10931.n7.nabble.com/Neutron-port-forwarding-for-router-td46639.html
[9] http://openstack.10931.n7.nabble.com/Neutron-port-forwarding-from-gateway-to-internal-hosts-td32410.html

Some more descriptions:

Gal Sagie (gal-sagie) on 2015-09-02
Changed in neutron:
assignee: nobody → Gal Sagie (gal-sagie)
tags: added: rfe
description: updated
Henry Gessau (gessau) on 2015-11-24
summary: - Add port fowrading extension to L3
+ [RFE] Add TCP/UDP port forwarding extension to L3
Akihiro Motoki (amotoki) on 2015-11-24
Changed in neutron:
importance: Undecided → Wishlist
status: New → Confirmed

I like Port forwarding don't get me wrong, but (as mentioned in the spec), providing this in a DVR context is challenging if not impossible under current circumstances, and therefore this becomes a hurdle for us if we want to provide a consistent user experience. Furthermore, this spec/feature has received very little attention both from reviewers and submitters, reflecting the fact that perhaps there isn't much appetite in solving this right now. Finally, the container use case presented is interesting, but I would imagine that port-forwarding is not exactly top priority (but I may be mistaken).

For these reasons, and until more clarity can be provided on some of the aspects raised in the spec, I'd say this may end up being deferred.

Changed in neutron:
status: Confirmed → Incomplete
assignee: Gal Sagie (gal-sagie) → nobody
Wenxin Wang (stieizc-33) wrote :

I've came across an environment with a shortage of ipv4 addresses, where port forwarding with fixed ips would really help. It seems from the spec that port forwarding on fixed ips in DVR is easier to implement than forwarding on floating ips (just like the SNAT part on the network node). Maybe this could be done first. I may be wrong, though.

I had no experience with DVR, but it seems from the Networking Guide[1] that port forwarding on floating ips have to be done in the relevant compute node.

Wenxin Wang (stieizc-33) wrote :

Sorry for the extra comment, I forgot to give the reference link.

[1] http://docs.openstack.org/networking-guide/scenario_dvr_ovs.html#architecture

Launchpad Janitor (janitor) wrote :

[Expired for neutron because there has been no activity for 60 days.]

Changed in neutron:
status: Incomplete → Expired
Oleg Ilin (oilyin) on 2016-08-23
Changed in neutron:
assignee: nobody → Oleg Ilin (oilyin)
status: Expired → Incomplete
status: Incomplete → Opinion

This expired because it lacks volunteers both review and development side, and that may fundamentally stem from the fact that no-one thinks it's a high priority use case.

Changed in neutron:
status: Opinion → Incomplete
status: Incomplete → Confirmed

We are not processing RFEs at this point during the release cycles

ilnurgi (ilnurgi87) wrote :


I implemented it.

neutron portforwarding-list ...
neutron portforwarding-show ...
neutron portforwarding-create ...
neutron portforwarding-delete ...

I'm ready to contribute this

Oleg Ilin (oilyin) on 2016-08-24
Changed in neutron:
assignee: Oleg Ilin (oilyin) → nobody
assignee: nobody → Oleg Ilin (oilyin)
ilnurgi (ilnurgi87) on 2016-08-24
Changed in neutron:
assignee: Oleg Ilin (oilyin) → ilnurgi (ilnurgi87)

@ilnurgi, you said you 'implemented it'. Do you have patches to refer to? Are you going to revive the spec?

More importantly, who is going to work on the code *and* drive the feature to completion from review side? Is L3 subteam onboard with the idea for Ocata and is willing to trade some other ongoing work to that feature?

Kevin Benton (kevinbenton) wrote :

@Ihar, perhaps comment 8 *is* the implementation. :)

ilnurgi (ilnurgi87) on 2016-11-23
Changed in neutron:
assignee: ilnurgi (ilnurgi87) → nobody

in #11, it looks like we just lost our committer. Again, nice feature, not enough traction.

Changed in neutron:
status: Confirmed → Incomplete
Reedip (reedip-banerjee) wrote :

If possible, can I take it for Pike ?

Changed in neutron:
assignee: nobody → Reedip (reedip-banerjee)
Reedip (reedip-banerjee) on 2017-01-25
description: updated
brenda (tian-mingming) wrote :

Hi, Reedip. I am also intersted in this feature. I have posted a message in mail list, but no response. I don't know why.

Fix proposed to branch: master
Review: https://review.openstack.org/470596

Changed in neutron:
status: Incomplete → In Progress
Changed in neutron:
status: In Progress → Triaged
Kevin Benton (kevinbenton) wrote :

The RFE is approved, but the spec needs to clearly define how this will work with DVR and HA routers. We don't want an implementation that only works with certain types of routers.

tags: added: rfe-approved
removed: rfe
Changed in neutron:
status: Triaged → In Progress
Changed in neutron:
assignee: Reedip (reedip-banerjee) → zhaobo (zhaobo6)
Changed in neutron:
assignee: zhaobo (zhaobo6) → Reedip (reedip-banerjee)
Changed in neutron:
assignee: Reedip (reedip-banerjee) → zhaobo (zhaobo6)
Changed in neutron:
assignee: zhaobo (zhaobo6) → Reedip (reedip-banerjee)
Changed in neutron:
assignee: Reedip (reedip-banerjee) → zhaobo (zhaobo6)
Changed in neutron:
assignee: zhaobo (zhaobo6) → Reedip (reedip-banerjee)
Changed in neutron:
assignee: Reedip (reedip-banerjee) → zhaobo (zhaobo6)

Reviewed: https://review.openstack.org/470596
Committed: https://git.openstack.org/cgit/openstack/neutron-specs/commit/?id=66eb7e172912acbeb7670d7154a9686bb0726c47
Submitter: Zuul
Branch: master

commit 66eb7e172912acbeb7670d7154a9686bb0726c47
Author: Reedip <email address hidden>
Date: Sat Jun 3 06:07:38 2017 +0000

    Spec for Port Forwarding

    The following spec specifies the Port Forwarding extension
    for Floating IPs. And intro a new sub resource into floatingip for port
    forwarding support.

    Depends-On: If40305044c9dfe0024b64bd3921232bb0a6c9372
    Change-Id: Ib2c47b585538bbc067a488e34fd0fc8097314f98
    Partial-Bug: #1491317

Szabolcs Gelencsér (h3yduck) wrote :

hey folks,

What is the expected date of releasing this enhancement in neutron? We would really need this, is there anything I can help with?

Changed in neutron:
assignee: zhaobo (zhaobo6) → Reedip (reedip-banerjee)
Reedip (reedip-banerjee) wrote :

Hi Szabolcs ,
I updated the patches which are resolving this bug.
The list of patches are in https://review.openstack.org/#/q/topic:bp/port-forwarding+(status:open+OR+status:merged)

Changed in neutron:
assignee: Reedip (reedip-banerjee) → zhaobo (zhaobo6)
Changed in neutron:
assignee: zhaobo (zhaobo6) → Slawek Kaplonski (slaweq)

Reviewed: https://review.openstack.org/535638
Committed: https://git.openstack.org/cgit/openstack/neutron-lib/commit/?id=0de474f396d5bba9aeb37e774f56e30d72334837
Submitter: Zuul
Branch: master

commit 0de474f396d5bba9aeb37e774f56e30d72334837
Author: reedip <email address hidden>
Date: Mon Apr 23 16:39:50 2018 +0800

    Introduce API definition of Floating IP Port Forwarding

    This patch introduces the port forwarding API definition which extends
    the current Floating IP API.

    This patch partially implements the following spec:

    Change-Id: I86adb014c5c9b55b00085849c3ebdd38adfed85b
    Co-Authored-By: zhaobo <email address hidden>
    Partial-Bug: #1491317

Changed in neutron:
assignee: Slawek Kaplonski (slaweq) → zhaobo (zhaobo6)

Fix proposed to branch: master
Review: https://review.openstack.org/575326

Reviewed: https://review.openstack.org/578764
Committed: https://git.openstack.org/cgit/openstack/neutron-lib/commit/?id=e863e8f1cd25a786fe416e94185f250eb1191d2f
Submitter: Zuul
Branch: master

commit e863e8f1cd25a786fe416e94185f250eb1191d2f
Author: ZhaoBo <email address hidden>
Date: Thu Jun 28 18:41:00 2018 +0800

    Extend port_forwardings field in Floatingip response

    This patch introduces a new API extension for exposing
    port_forwardings field in Floatingip response.

    This extension requires the router and port_forwarding service plugins.

    This change implements the effect of port forwarding on
    the existing Floatingip API, as specified in [1]


    Change-Id: Ia35b57fb26a0cf277f31816e90d24f91ca1f63d1
    Partial-Bug: #1491317

Reviewed: https://review.openstack.org/535647
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=5bd6281f9cf2362cd2964b2e7c2e7cbc479d9461
Submitter: Zuul
Branch: master

commit 5bd6281f9cf2362cd2964b2e7c2e7cbc479d9461
Author: ZhaoBo <email address hidden>
Date: Tue Jul 3 15:45:44 2018 +0800

    [server side] Floating IP port forwarding OVO and db script

    This patch implements the port forwarding OVO and db layer code.
    Such as:
    * Introduces a new OVO named 'PortForwarding'.
    * Introduces a new db model for OVO.
    * A migration db script for port forwarding function.

    Partially-Implements: blueprint port-forwarding
    This patch partially implements the following spec:

    The race issue fix in:

    Fip extend port forwarding field addition in:

    Partial-Bug: #1491317
    Change-Id: If24e1b3161e2a86ccc5cc21acf05d0a17f6856e7

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Related blueprints