Repository navigation
Issue with hairpinning for port forwarding #3763
Description
ISSUE TYPE
- Bug Report
COMPONENT NAME
VR
CLOUDSTACK VERSION
4.12
CONFIGURATION
OS / ENVIRONMENT
SUMMARY
When we upgraded from 4.10 to 4.12, we noticed that hairpinning had started failing in VMs that were port-forwarded. We believe that we were able to track the change back to this PR, specifically the if statement added at line 479 in CsAddress.py.
I understand why it was added (and have verified the issues Private Gateways have without it while
trying to fix it on our own), but we'd still like to be able to add in the hairpinning feature that was lost when we upgraded.
STEPS TO REPRODUCE
* Create a VPC, with a network and VM inside that network.
* Create a public IP and port forward it to that VM.
* Either SSH into the VM or open its console and attempt to telnet on a port opened that public IP (i.e., telnet 172.30.202.29 22, if port forwarding port 22).
EXPECTED RESULTS
Telnet should be able to connect to the port exposed through port forwarding. iptables should look similar to this:
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT all -- * eth2 10.123.1.0/24 0.0.0.0/0 to:10.123.1.1
222 16681 SNAT all -- * eth1 0.0.0.0/0 0.0.0.0/0 to:172.30.202.28
0 0 SNAT all -- * eth1 0.0.0.0/0 0.0.0.0/0 to:172.30.202.29
0 0 SNAT tcp -- * * 0.0.0.0/0 172.30.202.29 tcp dpt:22 to:10.123.1.96:22
ACTUAL RESULTS
Telnet is unable to connect to the port. iptables looks like this:
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
222 16681 SNAT all -- * eth1 0.0.0.0/0 0.0.0.0/0 to:172.30.202.28
0 0 SNAT all -- * eth1 0.0.0.0/0 0.0.0.0/0 to:172.30.202.29
0 0 SNAT tcp -- * * 0.0.0.0/0 172.30.202.29 tcp dpt:22 to:10.123.1.96:22
Activity
weizhouapache commentedon Jan 30, 2020
@kovukono I have two questions
(1) Is the port allowed in ACL list which vpc tier uses ?
(2) Can you reproduce this issue in 4.13 ?
kovukono commentedon Jan 30, 2020
@weizhouapache
weizhouapache commentedon Jan 31, 2020
@kovukono thanks
I can reproduce the issue in 4.13 as well.
yadvr commentedon Jan 31, 2020
@weizhouapache added the 4.13.1 milestone, can you help work on a fix for it? Thanks.
weizhouapache commentedon Jan 31, 2020
@rhtyd I have found the root cause. I am testing the fix now.