Hide Forgot
Description of problem: With local gateway mode when external traffic policy is used the source address should not be NAT'ed on its way to the destination endpoint. This works as expected until ovnkube-node is restarted. At this point the iptables rules get configured in the wrong order, so that the packets are SNAT'ed to teh management (mp0) interface: Before restart: Chain OVN-KUBE-SNAT-MGMTPORT (1 references) target prot opt source destination RETURN tcp -- anywhere anywhere tcp dpt:30486 RETURN udp -- anywhere anywhere udp dpt:32397 SNAT all -- anywhere anywhere /* OVN SNAT to Management Port */ to:10.244.1.2 After restart: Chain OVN-KUBE-SNAT-MGMTPORT (1 references) target prot opt source destination SNAT all -- anywhere anywhere /* OVN SNAT to Management Port */ to:10.244.1.2 RETURN tcp -- anywhere anywhere tcp dpt:30486 RETURN udp -- anywhere anywhere udp dpt:32397 Accessing service endpoint before and after restart: [root@trozet3 /]# python -m SimpleHTTPServer 80 Serving HTTP on 0.0.0.0 port 80 ... 172.18.0.4 - - [13/Jul/2022 17:11:13] "GET / HTTP/1.1" 200 - 172.18.0.4 - - [13/Jul/2022 17:15:36] "GET / HTTP/1.1" 200 - 10.244.1.2 - - [13/Jul/2022 17:16:57] "GET / HTTP/1.1" 200 - <---After restart, ip is SNAT'ed to mp0
Related upstream issue: https://github.com/ovn-org/ovn-kubernetes/issues/2969
https://bugzilla.redhat.com/show_bug.cgi?id=2107309#c1 will fix the cause of this issue
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.12.0 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:7399