Also on the 'Node1', floatingIP is configured but the DNAT rule is missing in the router namespace. stack@ubuntu-controller:~/devstack$ neutron floatingip-list neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead. +--------------------------------------+----------------------------------+------------------+---------------------+--------------------------------------+ | id | tenant_id | fixed_ip_address | floating_ip_address | port_id | +--------------------------------------+----------------------------------+------------------+---------------------+--------------------------------------+ | 0fd57315-51d7-4277-9835-e3aee82a5773 | 948bc6fadbbc4ca4ad4d223dcc76b9f1 | 10.0.0.3 | 192.168.100.104 | 9187cca2-a96f-495f-abf4-041de154fc95 | | 5ad5be80-f720-47b0-a05e-4b309d192daf | 948bc6fadbbc4ca4ad4d223dcc76b9f1 | 10.0.0.13 | 192.168.100.100 | 95e78c3c-21a2-4d62-9fc9-ad5451ef73cd | | 6fc89fb9-ffc7-438d-8320-23c44de2ab09 | 948bc6fadbbc4ca4ad4d223dcc76b9f1 | 10.0.0.14 | 192.168.100.114 | e4b5e14e-6625-4bbb-884c-36f94dbc609d | +--------------------------------------+----------------------------------+------------------+---------------------+--------------------------------------+ root@ubuntu-controller:~/devstack# iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -N neutron-l3-agent-OUTPUT -N neutron-l3-agent-POSTROUTING -N neutron-l3-agent-PREROUTING -N neutron-l3-agent-float-snat -N neutron-l3-agent-snat -N neutron-postrouting-bottom -A PREROUTING -j neutron-l3-agent-PREROUTING -A OUTPUT -j neutron-l3-agent-OUTPUT -A POSTROUTING -j neutron-l3-agent-POSTROUTING -A POSTROUTING -j neutron-postrouting-bottom -A neutron-l3-agent-POSTROUTING ! -i rfp-6f01678c-6 ! -o rfp-6f01678c-6 -m conntrack ! --ctstate DNAT -j ACCEPT -A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -i qr-+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697 -A neutron-l3-agent-snat -j neutron-l3-agent-float-snat -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-l3-agent-snat There are not "DNAT" rules seen in the router namespace. But the IP rule shows 54170: from 10.0.0.3 lookup 16 is defined. root@ubuntu-controller:~/devstack# ip rule 0: from all lookup local 32766: from all lookup main 32767: from all lookup default 54170: from 10.0.0.3 lookup 16 167772161: from 10.0.0.1/28 lookup 167772161 root@ubuntu-controller:~/devstack# The fipnamespace also has the routes required to route the traffic for the floatingip. (192.168.100.104). stack@ubuntu-controller:~/devstack$ sudo ip netns exec fip-5c94b420-0b1f-4025-864a-9209d8e7211f bash root@ubuntu-controller:~/devstack# ifconfig fg-687a771e-78 Link encap:Ethernet HWaddr fa:16:3e:81:97:2e inet addr:192.168.100.105 Bcast:192.168.100.255 Mask:255.255.255.0 inet6 addr: fe80::f816:3eff:fe81:972e/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:290 errors:0 dropped:0 overruns:0 frame:0 TX packets:114 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes:26045 (26.0 KB) TX bytes:15101 (15.1 KB) fpr-24ee8045-1 Link encap:Ethernet HWaddr 16:f4:be:5b:39:72 inet addr:169.254.119.67 Bcast:0.0.0.0 Mask:255.255.255.254 inet6 addr: fe80::14f4:beff:fe5b:3972/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:7 errors:0 dropped:0 overruns:0 frame:0 TX packets:9 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:738 (738.0 B) TX bytes:958 (958.0 B) fpr-6f01678c-6 Link encap:Ethernet HWaddr 32:44:92:f3:90:01 inet addr:169.254.113.29 Bcast:0.0.0.0 Mask:255.255.255.254 inet6 addr: fe80::3044:92ff:fef3:9001/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:96 errors:0 dropped:0 overruns:0 frame:0 TX packets:113 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:14345 (14.3 KB) TX bytes:19510 (19.5 KB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) root@ubuntu-controller:~/devstack# ip route 169.254.113.28/31 dev fpr-6f01678c-6 proto kernel scope link src 169.254.113.29 169.254.119.66/31 dev fpr-24ee8045-1 proto kernel scope link src 169.254.119.67 192.168.100.0/24 dev fg-687a771e-78 proto kernel scope link src 192.168.100.105 192.168.100.104 via 169.254.113.28 dev fpr-6f01678c-6 root@ubuntu-controller:~/devstack# exit