<div dir="ltr">I think external gateway routes are accepted now.<div>The code just checks against the CIDRs of all ports belonging to the router. [1]</div><div><br></div><div><br></div><div>1. <a href="https://github.com/openstack/neutron/blob/a2fff6ee728db57f0e862548aac9296899ef0fc7/neutron/db/extraroute_db.py#L106">https://github.com/openstack/neutron/blob/a2fff6ee728db57f0e862548aac9296899ef0fc7/neutron/db/extraroute_db.py#L106</a></div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jul 23, 2014 at 8:12 PM, Carl Baldwin <span dir="ltr"><<a href="mailto:carl@ecbaldwin.net" target="_blank">carl@ecbaldwin.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">I wondered the same as Kevin. Could you confirm that the vpn gateway is directly connected to the external subnet or not? The diagram isn't quite clear</p>
<p dir="ltr">Assuming it is directly connected then it is probable that routes through the external gateway are not considered, hence the error you received. It seems reasonable to me to consider a proposal that would allow this. It should be an admin only capability by default since it would be over the external (shared) network and not a tenant network. This seems like a new feature rather than a bug to me.</p>
<p dir="ltr">As an alternative, could you try configuring your router with the static route so that it would send an icmp redirect to the neutron router?</p><span class="HOEnZb"><font color="#888888">
<p dir="ltr">Carl</p></font></span><div class="HOEnZb"><div class="h5">
<div class="gmail_quote">On Jul 22, 2014 11:23 AM, "Kevin Benton" <<a href="mailto:blak111@gmail.com" target="_blank">blak111@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">The issue (if I understand your diagram correctly) is that the VPN GW address is on the other side of your home router from the neutron router. The nexthop address has to be an address on one of the subnets directly attached to the router. In this topology, the static route should be on your home router.<div>
<br></div><div>--</div><div>Kevin Benton</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jul 22, 2014 at 6:55 AM, Ricardo Carrillo Cruz <span dir="ltr"><<a href="mailto:ricardo.carrillo.cruz@gmail.com" target="_blank">ricardo.carrillo.cruz@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello guys<div><br></div><div>I have the following network setup at home:</div><div><br></div><div>[openstack instances] -> [neutron router] -> [ [home router] [vpn gw] ]</div>
<div> TENANT NETWORK EXTERNAL NETWORK</div>
<div><br></div><div>I need my instances to connect to machines that are connected thru the vpn gw server.</div><div>By default, all traffic that comes from openstack instances go thru the neutron router, and then hop onto the home router.</div>
<div><br></div><div>I've seen there's an extra routes extension for neutron routers that would allow me to do that, but apparently I can't add extra routes to destinations in the external network, only subnets known by neutron.</div>
<div>This can be seen from the neutron CLI command:</div><div><br></div><div><snip></div><div>neutron router-update <router name> --routes type=dict list=true destination=<network connected by VPN in CIDR>,nexthop=<vpn gw IP><br>
</div><div>Invalid format for routes: [{u'nexthop': u'<vpn gw IP>', u'destination': u'<network connected by VPN in CIDR>'}], the nexthop is not connected with router<br></div><div>
</snip></div><div><br></div><div>Is this use case not being possible to do at all?</div><div><br></div><div>P.S.</div><div>I found Heat BP <a href="https://blueprints.launchpad.net/heat/+spec/router-properties-object" target="_blank">https://blueprints.launchpad.net/heat/+spec/router-properties-object</a> that in the description reads this can be done on Neutron, but can't figure out how.</div>
<div><br></div><div>Regards </div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div>Kevin Benton</div>
</div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div>
</div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div>Kevin Benton</div>
</div>