Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Received-SPF: pass (nike.apache.org: domain of shadwell@me.com designates
 17.172.220.237 as permitted sender)
Content-type: text/plain; charset=utf-8
MIME-version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
Subject: Re: SNAT and remote IP problem
From: Paul Shadwell <shadwell@me.com>
In-reply-to: 
 <CAMvtBPOrMnpjrwYKqCKiUCQa6VpH9HOU9oO139w3v3GWitMJDQ@mail.gmail.com>
Date: Wed, 18 Mar 2015 10:47:54 +0100
Cc: "dev@cloudstack.apache.org" <dev@cloudstack.apache.org>
Content-transfer-encoding: quoted-printable
Message-id: <B158327C-C8C2-4F72-B509-87063222DC77@me.com>
References: 
 <CAMvtBPOrMnpjrwYKqCKiUCQa6VpH9HOU9oO139w3v3GWitMJDQ@mail.gmail.com>
To: users@cloudstack.apache.org

I also have this problem, it effects running vPBX/VoIP services behind a =
VR.

In fact any service that requires a view on incoming IPs and domain =
names.

For example fail2ban will block ALL access to ssh because it only ever =
sees the VR IP address.

Upgrading to 4.3.2 did not fix it.

This needs fixing urgently.

Best regards

Paul


> On 17 Mar 2015, at 14:01, Andrija Panic <andrija.panic@gmail.com> =
wrote:
>=20
> Hi,
>=20
> is anybody willing to share the result from the folowing command, run =
in VR
> (VPC VR):
>=20
> iptables -t nat -nvL
>=20
> This should preferable be run from SSH-to-VR, instead of
> ConsoleProxy-to-VR, because of nice output over SSH.
>=20
>=20
> It seems in 4.3.0 and 4.3.2, SNAT is done on ALL incoming connections, =
no
> matter to WHAT IP  the traffic from internet came - primary IP, or
> additional one that is used for i.e. Static NAT - so SNAT rules always
> replace remote cleint IP with MAIN IP of the VPC...
>=20
> Please share your examples - this is serious bug in my opinion, and I =
wil
> raise JIRA - but would like some examples from other guys first.
>=20
> THanks,
>=20
> --=20
>=20
> Andrija Pani=C4=87