<div dir="ltr"><div>Cool! You're welcome! =)<br></div><div><br></div><div>My topology is "Per-Tenant Router with Private Networks", it does looks like your first example but, a bit different, like this:</div>
<div><br></div><div>---</div><div>Yours:</div><div><br></div><div><div>Internet ---- public-network ---- OpenStack-Router ---- Private-OpenStack-Network ---- NAT-Instance</div><div> |</div>
<div> -- Other-Instances</div></div><div>-</div><div>Mine:</div><div><br></div>
<div><div>Internet ---- public-network ---- OpenStack-Router ---- Private-OpenStack-Network ---- NAT-Instance</div><div> |</div>
<div> -- Other-Instances</div></div><div class="gmail_extra">---</div><div class="gmail_extra"><br>
</div>
<div class="gmail_extra">The "NAT Instance" is just a regular Instance (plus its Floating IP), there is nothing "connected behind it" (i.e. no eth0 public / eth1 private), it is "parallel / side-by-side" to the others Instances, the network traffic comes in and out the "NAT Instance" trough the same ethernet interface (another creepy point of this IPv4 topology).</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Best,</div><div class="gmail_extra">Thiago</div><div class="gmail_extra"><br><div class="gmail_quote">On 19 December 2013 15:31, Abbass MAROUNI <span dir="ltr"><<a href="mailto:abbass.marouni@virtualscale.fr" target="_blank">abbass.marouni@virtualscale.fr</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear Thiago,<div><br></div><div>Thanks a lot for your answer.</div><div><br></div><div>One more thing, do your configuration look something like this :</div>
<div><br></div><div>
<br></div><div>Internet ---- public-network ---- OpenStack-Router ---- Private-OpenStack-Network ---- NAT-Instance</div><div> |</div>
<div> -- Other-Instances</div><div><br></div><div>I tried setting up a dedicated router/firewall but couldn't make to work, it looks something like :</div>
<div><br></div><div>Internet ---- public-network ---- OpenStack-Router ---- Private-OpenStack-Network ---- Dedicated-Router (A VM) ---- Private-OpenStack-Network-2 ---- Other-Instances<br></div><div><br>
</div><div><br></div><div>For some reason the above configuration fails to deliver the packets to the 'Other-Instances', the 'Other-instances' use the Dedicated-Router as their gateway. Another drawback is the cloud-init of the 'Other-Instances'.</div>
<div><br></div><div>So I decided to try my luck with the first configuration, but it didn't work also. Maybe my iptables for the NAT-Instance were wrong. I'll try yours tomorrow !</div><div><br></div>
<div>Thanks a lot,</div><div><br></div><div>Best Regards,</div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">2013/12/19 Martinx - $B%8%'!<%`%:(B <span dir="ltr"><<a href="mailto:thiagocmartinsc@gmail.com" target="_blank">thiagocmartinsc@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Abbass,<div><br></div><div>The only way I figured out to do this, is by creating a "NAT Instance", with a Floating IP attached to it and, the "magic" happens here:</div>
<div><br></div><div>
Contents of my /etc/network/nat-rules.save</div><div><br></div><div>---</div><div><div><font face="courier new, monospace"># Generated by iptables-save v1.4.12 on Fri Oct 18 02:41:35 2013</font></div><div><font face="courier new, monospace">*filter</font></div>
<div><font face="courier new, monospace">:INPUT ACCEPT [0:0]</font></div><div><font face="courier new, monospace">:FORWARD ACCEPT [0:0]</font></div><div><font face="courier new, monospace">:OUTPUT ACCEPT [0:0]</font></div>
<div><font face="courier new, monospace">COMMIT</font></div><div><font face="courier new, monospace"># Completed on Fri Oct 18 02:41:35 2013</font></div><div><font face="courier new, monospace"># Generated by iptables-save v1.4.12 on Fri Oct 18 02:41:35 2013</font></div>
<div><font face="courier new, monospace">*nat</font></div><div><font face="courier new, monospace">:PREROUTING ACCEPT [0:0]</font></div><div><font face="courier new, monospace">:INPUT ACCEPT [0:0]</font></div><div><font face="courier new, monospace">:OUTPUT ACCEPT [0:0]</font></div>
<div><font face="courier new, monospace">:POSTROUTING ACCEPT [0:0]</font></div><div><font face="courier new, monospace">-A PREROUTING -d <a href="http://192.168.50.2/32" target="_blank">192.168.50.2/32</a> -p tcp -m tcp --dport 80 -j DNAT --to-destination <a href="tel:192.168.50.11" value="+551921685011" target="_blank">192.168.50.11</a></font></div>
<div><font face="courier new, monospace">-A PREROUTING -d <a href="http://192.168.50.2/32" target="_blank">192.168.50.2/32</a> -p tcp -m tcp --dport 443 -j DNAT --to-destination <a href="tel:192.168.50.11" value="+551921685011" target="_blank">192.168.50.11</a></font></div>
<div><font face="courier new, monospace">-A PREROUTING -d <a href="http://192.168.50.2/32" target="_blank">192.168.50.2/32</a> -p tcp -m tcp --dport 25 -j DNAT --to-destination <a href="tel:192.168.50.20" value="+551921685020" target="_blank">192.168.50.20</a><br>
</font></div><div><font face="courier new, monospace">-A POSTROUTING ! -d <a href="http://192.168.50.2/32" target="_blank">192.168.50.2/32</a> -j SNAT --to-source 192.168.50.2<br></font></div><div><font face="courier new, monospace">COMMIT</font></div>
<div><font face="courier new, monospace"># Completed on Fri Oct 18 02:41:35 2013</font></div></div><div>---</div><div><br></div><div>Where:</div><div><br></div><div>1- The IP 192.168.50.2 is the "Nat Instance" itself, with a "public and valid Floating IP" attached to it;</div>
<div><br></div><div>2- The IP <a href="tel:192.168.50.11" value="+551921685011" target="_blank">192.168.50.11</a> is a Web Server, that the Internet needs to access;</div><div><br></div><div>3- The IP <a href="tel:192.168.50.20" value="+551921685020" target="_blank">192.168.50.20</a> is a Mail MX Server, so, the tenant can receive e-mails;</div>
<div><br></div>
<div>4- The latest line is the creepiest, it is required because the NAT Instance, is not the default gateway of the tenant network, so, you'll require to "MASQ" both source and destination address.</div><div>
<br></div><div><br></div><div>This topology is "famous" even when using Amazon EC2 with private VPC, for example. But, honestly, I think it is terrible, mostly because of IPv4. This brings lots of problems, for example:</div>
<div><br></div><div>* web server logs will register only the "NAT" Instance internal IP;</div><div><br></div><div>* if you have a e-mail server instance, you'll need to figure out by yourself, the qrouter- public IP, to register it as an allowed IP (SPF) to send e-mails as your domain + plus register the "Reverse DNS" of the router Floating IP, as your e-mail (horrible)....</div>
<div><br></div><div>* And problems go on...</div><div><br></div><div><br></div><div>BTW, with IPv6 all those things will be left in the past, since NAT is a workaround of IPv4 networks and there is no NAT for IPv6 (when with Ubuntu 12.04). So, when with IPv6, there will be no "NAT Instance" or NAT rules to mange at the router (far much simpler and beauty) and your network will ALWAYS work as expected, we just need to wait a few months to join the future without any NAT!</div>
<div><br></div><div>Regards,</div><div>Thiago</div><div><br></div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On 19 December 2013 14:35, Abbass MAROUNI <span dir="ltr"><<a href="mailto:abbass.marouni@virtualscale.fr" target="_blank">abbass.marouni@virtualscale.fr</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Could you please elaborate about your temporary solution ?<div>I couldn't get a VM to act as a router that will do the port forwarding for other VMs in a private network. For some reason the VM cannot act as a router.</div>
<div>Is it due to neutron networking ? </div><div><br></div><div>Best regards,</div><div> </div></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/12/19 Martinx - $B%8%'!<%`%:(B <span dir="ltr"><<a href="mailto:thiagocmartinsc@gmail.com" target="_blank">thiagocmartinsc@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I'm wondering about this too... I think that would be very nice to give the FWaaS, the ability to manage the NAT table of tenant router.<div>
<br></div><div>This way, there is no need for a "NAT Instance" with a second Floating IP attached to it plus creepy NAT rules there (far away from the tenant router).</div>
<div><br></div><div>Also, the IPv4 tenant router already have "by nature", 1 Floating IP for it, so, because there is no way to configure the NAT rules of the qrouter, we need to give at least 2 public IPs (one for the router itself, another for the "NAT Instance") for each tenant, with in IPv4 world, is a waste.</div>
<div><br></div><div>Please Stackers! FWaaS needs to be able to handle NAT rules (I think)... ;-)</div><div><br></div><div>Cheers!</div><div>Thiago</div></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div>
<div>On 19 December 2013 12:23, Abbass MAROUNI <span dir="ltr"><<a href="mailto:abbass.marouni@virtualscale.fr" target="_blank">abbass.marouni@virtualscale.fr</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">Hello,<div><br></div><div>Why is it not possible to do port forwarding with neutron L3 ?</div>
<div>Any alternative to manually adding to iptables of each virtual router ?</div>
<div><br></div>
<div>Best regards,</div></div>
<br></div></div>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div></div>