You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "cdfgallo (via GitHub)" <gi...@apache.org> on 2024/05/07 14:29:44 UTC
[I] Port-forwarding not working in VPC Virtual Router [cloudstack]
cdfgallo opened a new issue, #9053:
URL: https://github.com/apache/cloudstack/issues/9053
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete the comments.
-->
##### ISSUE TYPE
<!-- Pick one below and delete the rest -->
* Bug Report
##### COMPONENT NAME
<!--
Categorize the issue, e.g. API, VR, VPN, UI, etc.
-->
~~~
VR in VPC
~~~
##### CLOUDSTACK VERSION
<!--
New line separated list of affected versions, commit ID for issues on main branch.
-->
~~~
4.19
~~~
##### CONFIGURATION
<!--
Information about the configuration if relevant, e.g. basic network, advanced networking, etc. N/A otherwise
-->
Advanced networking, VPC network
##### OS / ENVIRONMENT
<!--
Information about the environment if relevant, N/A otherwise
-->
N/A
##### SUMMARY
<!-- Explain the problem/feature briefly -->
It looks like that, starting with CS version 4.19, the VR is not properly forwarding traffic to the VM when a port-forwarding rule is created on a secondary IP assigned to the VR.
##### STEPS TO REPRODUCE
<!--
For bugs, show exactly how to reproduce the problem, using a minimal test-case. Use Screenshots if accurate.
For new features, show how the feature would be used.
-->
<!-- Paste example playbooks or commands between quotes below -->
~~~
Create a VPC (or use an existing one).
Create a new network tier.
Create a new VM in the tier.
Assign a new Public IP address to the VR and configure a pf rule on it.
Create a new ACL rule allowing traffic on the public port selected.
Try to reach the service exposed on the VR.
~~~
<!-- You can also paste gist.github.com links for larger files -->
##### EXPECTED RESULTS
<!-- What did you expect to happen when running the steps above? -->
~~~
You should be able to reach the service
~~~
##### ACTUAL RESULTS
<!-- What actually happened? -->
<!-- Paste verbatim command output between quotes below -->
~~~
You can't reach the service. Executing a tcpdump on the VR I saw that traffic is not forwarded to the VM behind it and no nat rules were created in iptables.
Rebooting the VR or re-creating it doesn't resolve.
As a work-around (still a poor one) you can use LB service on the VR instead of PF. Haproxy works as expected.
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2098545862
Thanks for opening your first issue here! Be sure to follow the issue template!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2099045621
@cdfgallo I was able to reproduce the issue.
However, I think the ACL rule should use the private port, not the public port. If use private port, both LB/PF should work
The major issue in my testing is, LB on additional public IP range always works, even if the ACL rule list is set to "default_deny".
can you test and confirm it ? @cdfgallo
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2098781591
> @weizhouapache it looks similar but it's not related to the VM configuration but on the VR configuration. The issue is present if any configuration is applied on any other additional IP of the Virtual Router.
oh, I did not notice it, sorry @cdfgallo
are the public port and private port the same ?
can you share the output of `iptables-save` command in the VPC VR in both scenarios (lb and pf) ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2099909230
> > my finding is, the LB always works, no matter what ACL rules are. I have created an issue #9054
>
> I'd guess that LB works because its iptables rules are in the "INPUT" chain which is checked before the "FORWARD" chain (where the ACL for the tier resides).
>
agree @cdfgallo
thanks for the points.
> > > > The major issue in my testing is, LB on additional public IP range always works, even if the ACL rule list is set to "default_deny". can you test and confirm it ? @cdfgallo
> > >
> > >
> > > I'll try that @weizhouapache
> >
> >
> > thanks @cdfgallo If port forwarding works with the ingress rule with private port , can we close this issue ?
>
> @weizhouapache yes, we can close the issue!
closing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-5139838829
@daviftorres , as @weizhouapache and @cdfgallo agreed this could be closed I think you should open a new issue. Maybe expanding onto why the reason for closing it, does not apply to your situation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "cdfgallo (via GitHub)" <gi...@apache.org>.
cdfgallo commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2098676212
@weizhouapache it looks similar but it's not related to the VM configuration but on the VR configuration.
The issue is present if any configuration is applied on any other additional IP of the Virtual Router.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2099850322
> > @cdfgallo I was able to reproduce the issue. However, I think the ACL rule should use the private port, not the public port. If use private port, both LB/PF should work
>
> @weizhouapache using LB I was able to have it working allowing the public port in ACL rules, insted with port-forwarding it looks like it works with the private port, I'll keep that in mind.
>
my finding is, the LB always works, no matter what ACL rules are. I have created an issue #9054
> > The major issue in my testing is, LB on additional public IP range always works, even if the ACL rule list is set to "default_deny". can you test and confirm it ? @cdfgallo
>
> I'll try that @weizhouapache
thanks @cdfgallo
If port forwarding works with the ingress rule with private port , can we close this issue ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2098633575
@cdfgallo
the issue looks same as an issue I reported before: #8366
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "daviftorres (via GitHub)" <gi...@apache.org>.
daviftorres commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-5137921891
This issue is certainly present it latest version because I stumbled on it multiple times this week until I realized it was a known bug.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache closed issue #9053: Port-forwarding not working in VPC Virtual Router
URL: https://github.com/apache/cloudstack/issues/9053
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "cdfgallo (via GitHub)" <gi...@apache.org>.
cdfgallo commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2099889112
>
> my finding is, the LB always works, no matter what ACL rules are. I have created an issue #9054
>
I'd guess that LB works because its iptables rules are in the "INPUT" chain which is checked before the "FORWARD" chain (where the ACL for the tier resides).
> > > The major issue in my testing is, LB on additional public IP range always works, even if the ACL rule list is set to "default_deny". can you test and confirm it ? @cdfgallo
> >
> >
> > I'll try that @weizhouapache
>
> thanks @cdfgallo If port forwarding works with the ingress rule with private port , can we close this issue ?
@weizhouapache yes, we can close the issue!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "cdfgallo (via GitHub)" <gi...@apache.org>.
cdfgallo commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-2099774853
> @cdfgallo I was able to reproduce the issue. However, I think the ACL rule should use the private port, not the public port. If use private port, both LB/PF should work
>
@weizhouapache
using LB I was able to have it working allowing the public port in ACL rules, insted with port-forwarding it looks like it works with the private port, I'll keep that in mind.
> The major issue in my testing is, LB on additional public IP range always works, even if the ACL rule list is set to "default_deny". can you test and confirm it ? @cdfgallo
I'll try that @weizhouapache
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Port-forwarding not working in VPC Virtual Router [cloudstack]
Posted by "codewest (via GitHub)" <gi...@apache.org>.
codewest commented on issue #9053:
URL: https://github.com/apache/cloudstack/issues/9053#issuecomment-3440212086
I think this issue may need to be reopened. Port forwarding does not work with ACS 4.21 and SystemVM 4.20.2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org