Comments (4)
So, essentially, this doesn't mean "DNAT only traffic destined to IP 1.1.1.1 and port range 22-23", it means "DNAT traffic destined to IP 1.1.1.1 and select a new destination port from range 22-23".
Ah, okay. The term PAT got me confused and I thought it was like traditional port-forwarding. Is there a way to accomplish said thing, though?
Hmm, probably the only way is to add a (stateless maybe) ACL in the switch connecting to the router that does the DNAT. I guess that's a security group rule in OpenStack terminology.
from ovn.
Closing this as it's working as expected. Please feel free to continue the discussion but you might get more feedback by posting this question as an email to [email protected].
from ovn.
@modzilla99 If I understand correctly your use case I guess there's a confusion of terms here. The external_port_range
attribute on a NAT entry instructs OVN (and indirectly conntrack) what range of ports it should use when (D)NATing traffic destined to that IP:
Lines 3763 to 3767 in dc34b4d
With your example, ovn-nbctl --portrange lr-nat-add neutron-e6777adf-ec9f-4cf1-b954-736133ce5c3f dnat 1.1.1.1 10.0.0.250 22-23
, it's expected that NAT will change the destination IP to 10.0.0.250 and will select a destination port from the range 22, 23.
So, essentially, this doesn't mean "DNAT only traffic destined to IP 1.1.1.1 and port range 22-23", it means "DNAT traffic destined to IP 1.1.1.1 and select a new destination port from range 22-23".
Or did I misunderstand your scenario?
As a side note, it shouldn't be round-robin, it should be random. But maybe that's because you're missing this recent fix:
0ef388c
Thanks,
Dumitru
from ovn.
So, essentially, this doesn't mean "DNAT only traffic destined to IP 1.1.1.1 and port range 22-23", it means "DNAT traffic destined to IP 1.1.1.1 and select a new destination port from range 22-23".
Ah, okay. The term PAT got me confused and I thought it was like traditional port-forwarding. Is there a way to accomplish said thing, though?
As a side note, it shouldn't be round-robin, it should be random. But maybe that's because you're missing this recent fix: 0ef388c
Yes, we don't have that patch applied. Seems like its causing it.
Or did I misunderstand your scenario?
No you did not. Thanks for the clarification.
Best regards
from ovn.
Related Issues (20)
- [dgw] avoid snat on reply packets
- windows server 2012 can not get its ipv6 ip from ovn/ovs dhcp server HOT 4
- UDP port forwarding corrupts DNS packets HOT 5
- Does L3 HA support the `Router Specific Active-Backup` ??
- multiple external network dnat bug
- OVSDB-server of SBDB cluster node takes 100% CPU HOT 3
- no need skip conntrack for the lsp which peer is l3dgw_port HOT 1
- [Q&A + HELP] How to make k8s coredns work with OVN DNS HOT 12
- Installing ovn-21.12.2 and ovs-2.17.5 makes error HOT 2
- ovsdb follower always join the leader and status is catchup HOT 16
- permanent mac_bindig cause traffic blackhole HOT 5
- Make arpresponder less aggressive, reply only for broadcast arp requests
- When ACL is applied to a subnet, the action allow-related affects the other actions,such as drop HOT 7
- allow-related is not working for reply flow HOT 1
- how can i capture traffic usage of float ip and router port in ovn?
- Why the flow is needed for unknown mac addresses to send to the MC_UNKNOWN multicast group? HOT 4
- When ACL is applied to a subnet, affects ACL rules based on security groups, such as pg group? HOT 4
- can mac arm silicon m2 use openvswitch mod
- Hot upgrading OVN-controller | down time after restarting ovn_controller HOT 12
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ovn.