DNAT PortRange missbehaves about ovn HOT 4 CLOSED

So, essentially, this doesn't mean "DNAT only traffic destined to IP 1.1.1.1 and port range 22-23", it means "DNAT traffic destined to IP 1.1.1.1 and select a new destination port from range 22-23".

Ah, okay. The term PAT got me confused and I thought it was like traditional port-forwarding. Is there a way to accomplish said thing, though?

Hmm, probably the only way is to add a (stateless maybe) ACL in the switch connecting to the router that does the DNAT. I guess that's a security group rule in OpenStack terminology.

from ovn.

Closing this as it's working as expected. Please feel free to continue the discussion but you might get more feedback by posting this question as an email to [email protected].

from ovn.

@modzilla99 If I understand correctly your use case I guess there's a confusion of terms here. The external_port_range attribute on a NAT entry instructs OVN (and indirectly conntrack) what range of ports it should use when (D)NATing traffic destined to that IP:

With your example, ovn-nbctl --portrange lr-nat-add neutron-e6777adf-ec9f-4cf1-b954-736133ce5c3f dnat 1.1.1.1 10.0.0.250 22-23, it's expected that NAT will change the destination IP to 10.0.0.250 and will select a destination port from the range 22, 23.

So, essentially, this doesn't mean "DNAT only traffic destined to IP 1.1.1.1 and port range 22-23", it means "DNAT traffic destined to IP 1.1.1.1 and select a new destination port from range 22-23".

Or did I misunderstand your scenario?

As a side note, it shouldn't be round-robin, it should be random. But maybe that's because you're missing this recent fix:
0ef388c

Thanks,
Dumitru

from ovn.

So, essentially, this doesn't mean "DNAT only traffic destined to IP 1.1.1.1 and port range 22-23", it means "DNAT traffic destined to IP 1.1.1.1 and select a new destination port from range 22-23".

Ah, okay. The term PAT got me confused and I thought it was like traditional port-forwarding. Is there a way to accomplish said thing, though?

As a side note, it shouldn't be round-robin, it should be random. But maybe that's because you're missing this recent fix: 0ef388c

Yes, we don't have that patch applied. Seems like its causing it.

Or did I misunderstand your scenario?

No you did not. Thanks for the clarification.

Best regards

from ovn.