Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

multiple external network dnat bug #222

Open
zcq98 opened this issue Oct 24, 2023 · 0 comments
Open

multiple external network dnat bug #222

zcq98 opened this issue Oct 24, 2023 · 0 comments

Comments

@zcq98
Copy link

zcq98 commented Oct 24, 2023

The logical flow table cannot be delivered correctly

vpc1 is connected to two external networks, external and ext1.

switch 1eb412ce-2c44-4026-868a-550716d42277 (subnet2)
    port busybox06.vpc1
        addresses: ["00:00:00:49:1B:8B 192.100.0.4"]
    port subnet2-vpc1
        type: router
        router-port: vpc1-subnet2
switch 803f41ce-876f-4c7f-84a7-bab150e95281 (ext1)
    port ext1-vpc1
        type: router
        router-port: vpc1-ext1
    port localnet.ext1
        type: localnet
        addresses: ["unknown"]
switch e6e819c6-fa41-422e-ad56-166e7044fdd2 (subnet1)
    port busybox03.vpc1
        addresses: ["00:00:00:D2:9D:26 192.50.0.4"]
    port subnet1-vpc1
        type: router
        router-port: vpc1-subnet1
switch 38deb897-6fc1-47fc-a6dc-28f4fea45db0 (external)
    port localnet.external
        type: localnet
        addresses: ["unknown"]
    port external-vpc1
        type: router
        router-port: vpc1-external
router 4d2b3cee-2b71-4139-9d74-55627812f0d2 (vpc1)
    port vpc1-subnet2
        mac: "00:00:00:89:62:10"
        networks: ["192.100.0.1/24"]
    port vpc1-ext1
        mac: "00:00:00:84:CA:10"
        networks: ["192.168.94.128/24"]
        gateway chassis: [3ce122db-07fe-4ffb-a1ca-01b9ad8eaa8e]
    port vpc1-external
        mac: "00:00:00:A9:E1:4A"
        networks: ["192.168.80.128/24"]
        gateway chassis: [3ce122db-07fe-4ffb-a1ca-01b9ad8eaa8e]
    port vpc1-subnet1
        mac: "00:00:00:6C:8F:18"
        networks: ["192.50.0.1/24"]

vpc1 is also connected to two subnets:

  • subnet1:192.50.0.0/24
  • subnet1:192.100.0.0/24

Set the dnat of virtual machine 192.50.0.4 to 192.168.80.129
Set the dnat of virtual machine 192.100.0.4 to 192.168.94.129

The logical flow table of vpc1 is as follows:

Datapath: "vpc1" (0380a34b-91d1-4dba-9757-3f0233ce77f1)  Pipeline: ingress
 ......
 table=7 (lr_in_dnat), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 192.168.80.129 && tcp && reg9[16..31] == 80 && ct_mark.natted == 1 && is_chassis_resident("cr-vpc1-ext1")), action=(next;)
 table=7 (lr_in_dnat), priority=120  , match=(ct.est && !ct.rel && ip4 && reg0 == 192.168.94.129 && tcp && reg9[16..31] == 80 && ct_mark.natted == 1 && is_chassis_resident("cr-vpc1-ext1")), action=(next;)
 table=7 (lr_in_dnat), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 192.168.80.129 && tcp && reg9[16..31] == 80 && is_chassis_resident("cr-vpc1-ext1")), action=(ct_lb_mark(backends=192.50.0.4:80);)
 table=7 (lr_in_dnat), priority=120  , match=(ct.new && !ct.rel && ip4 && reg0 == 192.168.94.129 && tcp && reg9[16..31] == 80 && is_chassis_resident("cr-vpc1-ext1")), action=(ct_lb_mark(backends=192.100.0.4:80);)
 ......
Datapath: "vpc1" (0380a34b-91d1-4dba-9757-3f0233ce77f1)  Pipeline: egress
......
 table=1 (lr_out_undnat      ), priority=120  , match=(ip4 && ((ip4.src == 192.100.0.4 && tcp.src == 80)) && outport == "vpc1-ext1" && is_chassis_resident("cr-vpc1-ext1")), action=(ct_dnat_in_czone;)
 table=1 (lr_out_undnat      ), priority=120  , match=(ip4 && ((ip4.src == 192.50.0.4 && tcp.src == 80)) && outport == "vpc1-ext1" && is_chassis_resident("cr-vpc1-ext1")), action=(ct_dnat_in_czone;)
......

is_chassis_resident is not set correctly,and outport in Pipeline: egress is also not set correctly
the is_chassis_resident for 192.168.80.129 should be cr-vpc1-external and the outport should be vpc1-external

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant