router portforwarding

asked 2017-03-14 12:01:44 -0600

Javi gravatar image

Hi all,

We have not many public IPs so we must think about to use the Public Router IP to forward the traffic to the VM. As far as I know, we can create some iptables rules to do that.

These are which we are using but they don't work.

ip netns exec qrouter-xxxx iptables -t nat -I neutron-l3-agent-PREROUTING -p tcp -d RouterGW_IP -j DNAT --to VM_Internal_IP:22

ip netns exec qrouter-xxxx iptables -t nat -I neutron-l3-agent-snat -p tcp -s PUBLICfloating_IP --sport 22 -j SNAT --to RouterGW_IP

In this example:

RouterGW_IP is the Instance network gateway

VM_Internal_IP is the Instance Internal IP

PUBLICfloating_IP is the IP reached from Internet

What am I missing???

Note: We are using 3 Controllers with Neutron L3 HA on a Mitaka environment.

I also have followed the instructions from ( with no success.

THx in advance

edit retag flag offensive close merge delete

2 answers

Sort by » oldest newest most voted

answered 2017-03-15 04:32:26 -0600

Vinoth gravatar image

Associating floating IP to any OpenStack’s VM will send the packet via router’s Gateway with the source IP address as floating IP’s IP address. So don't associate floating IPs to the VMs.

Use the below NAT command to access the Openstack VM using the router's elastic IP:

   $ ip netns exec qrouter-f85bxxxx-61b2-xxxx-xxxx-xxxxba0xxxx iptables -t nat -A PREROUTING -p tcp  -d **RouterGW_IP**  –dport 522 -j DNAT –to-destination **VM_Internal_IP:22**

In the above command, I had NAT for forwarding all packets for RouterGW_IP with port 522

Using the above NAT command, All the packets reaching RouterGW_IP with port number 522 will be forwarded to VM_Internal_IP:22


edit flag offensive delete link more

answered 2017-03-15 11:26:32 -0600

Javi gravatar image

Thank you for the answer.

I created the rule on the router but I cannot reach the VM from the internet.

The rule I typed is: ip netns exec qrouter-xxx-xx-x-x iptables -t nat -A PREROUTING -p tcp -d RouterGW_IP --dport 522 -j DNAT --to-destination VM_Internal_IP:22

We miss something else because it doesnn't work. When I nmap the PublicIP (RouterGW_IP) from interntet all the ports are filtered. So maybe we must accept the forward ???

Thx in advance

edit flag offensive delete link more

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower


Asked: 2017-03-14 12:01:44 -0600

Seen: 1,194 times

Last updated: Mar 15 '17