Non snated packet should be blocked

[Takanori Miyagishi]

Some deployments would like to use only floating ip to communicate with outside of tenant via external network.

However, in current neutron, when running "neutron router-gateway-set" with specified router's "enable_snat" is false, then non-SNAT'ed packets can arrive at other tenant via external-network. The packets don't pass through other tenant's gateway, but take extra load to external network.

The packet should be NAT'ed when flowing on external network. Non-SNAT'ed packets don't need to flow on external network.

Therefore, non-SNAT'ed packets should be dropped at inside of own tenant.

I will fix as follows:

  * The router is Legacy mode and enable_snat is True:
    No change from current implementation.

  * The router is Legacy mode and enable_snat is False:
    Add new rule for dropping outbound non-SNAT'ed packets.

  * The router is DVR mode and enable_snat is True:
    No change from current implementation.

  * The router is Legacy mode and enable_snat is False:
    Don't create SNAT name space.

[James Denton (james-denton)]

There is a use case where SNAT is disabled on a Neutron router and there are upstream routes for tenant networks using the Neutron router as the next hop. What you're proposing would break that use case.

Also, enabling/disabling snat on a router is an admin-only function according to policy.json:

"create_router:external_gateway_info:enable_snat": "rule:admin_only",
"update_router:external_gateway_info:enable_snat": "rule:admin_only",

This is a non-issue for non-admin users/tenants.

[Takanori Miyagishi (miyagishi-t)]

I think it is useless that non-NAT'ed packet flows on external network from tenant network because the destination can't handle private IP of sender. Therefore, my opinion is the use case occurs when private IP is NAT'ed to public IP.

So, as I wrote in Bug Description, the current behavior that non-NAT'ed packet flows on external network is an issue. I'd like to fix this.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/272059

[Kevin Benton (kevinbenton)]

If you have SNAT disabled and don't want traffic to flow onto the external network, why would you attach an interface to the external network in the first place?

[Takanori Miyagishi (miyagishi-t)]

Hi Dariusz Smigiel,
Could you tell the reason for adding tag "rfe"?
I think this is just a bug.

[Dariusz Smigiel (smigiel-dariusz)]

Hey Takanori Miyagishi,
My mistake. I had wrong belief that it's something new.

Thank you for updating description for this.

[Kevin Benton (kevinbenton)]

This will break the use case that James pointed out. We can't just disable all non-SNAT traffic because the router on the external network could have routes pointing back to the tenant router for the tenant's networks.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Takanori Miyagishi (<email address hidden>) on branch: master
Review: https://review.openstack.org/272059

[Armando Migliaccio (armando-migliaccio)]

This bug is > 180 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]