GRE tunnels between VMs don't work when openvswitch firewall is used

[Slawek Kaplonski]

When openvswitch firewall driver is used, GRE tunnel configured inside 2 VMs don't work properly.
When iptables_hybrid driver is used all works fine.

[LIU Yulong (dragon889)]

Hi Slawek,
Could you please confirm if enable kod 'nf_conntrack_proto_gre' can fix the issue, or not?

[Slawek Kaplonski (slaweq)]

Hi LIU,

Indeed, loading this module solved the problem for me.
So now I'm wandering if neutron should load such module or should it just be documented properly?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/657784

[Slawek Kaplonski (slaweq)]

Ok, I think that docs update should be enough for this but lets check what others will say in review.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/657784
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=b8a18dc22a8d3b5fa4d5915399feea88d4ceed9f
Submitter: Zuul
Branch: master

commit b8a18dc22a8d3b5fa4d5915399feea88d4ceed9f
Author: Slawek Kaplonski <email address hidden>
Date: Wed May 8 14:16:49 2019 +0200

    Add info about nf_conntrack_proto_gre when ovs fw is used

    When openvswitch firewall driver is used, it is required to load
    nf_conntrack_proto_gre kernel module to make GRE tunnels from VM to VM
    working properly.
    This patch adds such info in ovs firewall documentation as it should be
    deployer decision to load or not load this module.

    This patch also adds sanity check which checks if nf_conntrack_proto_gre
    module is loaded or not, and can warn user when this module is not
    loaded.
    It also adds loading of this kernel module in neutron devstack plugin.

    Change-Id: Ic97ca00c804f0a540ee0dc53d9e4e07bf8410869
    Closes-Bug: #1828053

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 15.0.0.0b1 development milestone.