cloudstack-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From murali-reddy <>
Subject [GitHub] cloudstack pull request #1659: CLOUDSTACK-9339 Virtual Routers don't handle ...
Date Wed, 24 Aug 2016 10:45:45 GMT
GitHub user murali-reddy opened a pull request:

    CLOUDSTACK-9339 Virtual Routers don't handle Multiple Public Interfaces correctly for
non-vpc networks

    As pointed out in CLOUDSTACK-9339, in case of multiple public IP's from different public
IP ranges are associated with VR, VR functionality is broken. Below are the brief list of
problems specific to non VPC networks addressed in the PR.
    - revere traffic for the connections accepted on the eth3 and above public interfaces
are getting blocked. Need a rule for e.g "-A FORWARD -i  eth3 -o eth0 -m state --state RELATED,ESTABLISHED
-j ACCEPT" in the filter table to permit reverse path traffic
    - outbound public traffic from eth0 to eth3 (and above) needs rule to run through FW_OUTBOUND
chain in the filter table
    - network stats on public interfaces eth3 are getting gathered
    - default gateway is missing in the device specific routing table, resulting in traffic
to be looked up in main routing table
    - reating a device specific route table is generating "from all lookup Table_eth3" in
        ip rules, resulting in traffic getting blocked.
    Picked few commits from #1519 from dsclose (
submitted for 4.7
    Marvin tests are added to test below
    - Static NAT works on the public interfaces above eth2, in case non-vpc networks
    - Portforwarding works on the public interfaces above eth2, in case non-vpc networks
    - Route tables are configured as expected for the device specific table for the public
interfaces above eth2, in case non-vpc networks
    - IP tables rules are as expected for the traffic from and to the public interfaces above
eth2, in case non-vpc networks

You can merge this pull request into a Git repository by running:

    $ git pull multiple_public_ip_ranges_non_vpc

Alternatively you can review and apply these changes as the patch at:

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #1659
commit af55d84a0954a50d88387660a47c5eb3be09c8c0
Author: dean.close <>
Date:   2016-04-27T09:08:23Z

    CLOUDSTACK-9339: Allow forwarding and collect network stats on any public interface.

commit 7a2334d5c642a61f9275da240f834411ece5ced1
Author: Murali Reddy <>
Date:   2016-08-23T21:41:36Z

    only mark packets arriving on public interfaces. On guest networ interfaces
    mark only when they are part of static nat. this will ensure device specific
    routing table will be used

commit e85a638c751c8c5fab234176c1772e22a16d4431
Author: dean.close <>
Date:   2016-04-27T08:49:25Z

    CLOUDSTACK-9339: Add default gateway to device-specific routing tables.

commit fa2d3332b6b953341604091c005bec64224585c9
Author: Murali Reddy <>
Date:   2016-08-23T21:46:04Z

    smoke tests for multiple public ip ranges for non-vpc network scenarios


If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at or file a JIRA ticket
with INFRA.

View raw message