My router that connects the provider and tenant network is dropping the outgoing packets. I have attached floating ip to one of my instance and allowing the icmp traffic(both ingress, outgress). When I try to do a ping from outside, I see the echo replies getting dropped at the qg interface inside the router namespace.

   bash-4.2# ip netns exec qrouter-1306cecd-d55e-4a90-a9af-96be92779a1b ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: qg-dbeca7ef-4c: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether fa:16:3e:db:d0:de brd ff:ff:ff:ff:ff:ff
    inet 172.31.231.71/25 brd 172.31.231.127 scope global qg-dbeca7ef-4c
       valid_lft forever preferred_lft forever
    inet 172.31.231.72/32 brd 172.31.231.72 scope global qg-dbeca7ef-4c
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fedb:d0de/64 scope link
       valid_lft forever preferred_lft forever
3: qr-8e9060b7-b3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether fa:16:3e:67:a4:19 brd ff:ff:ff:ff:ff:ff
    inet 55.0.0.1/24 brd 55.0.0.255 scope global qr-8e9060b7-b3
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe67:a419/64 scope link
       valid_lft forever preferred_lft forever

If I do a tcpdump on the qr interface I see the reply from the instance are arriving

bash-4.2# ip netns exec qrouter-1306cecd-d55e-4a90-a9af-96be92779a1b tcpdump -i qr-8e9060b7-b3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on qr-8e9060b7-b3, link-type EN10MB (Ethernet), capture size 65535 bytes
00:14:47.124367 IP 10.157.8.162 > 55.0.0.4: ICMP echo request, id 39434, seq 2172, length 64
00:14:47.124538 IP 55.0.0.4 > 10.157.8.162: ICMP echo reply, id 39434, seq 2172, length 64
00:14:48.127992 IP 10.157.8.162 > 55.0.0.4: ICMP echo request, id 39434, seq 2173, length 64
00:14:48.128133 IP 55.0.0.4 > 10.157.8.162: ICMP echo reply, id 39434, seq 2173, length 64

but on the qg interface the replies are getting dropped

bash-4.2# ip netns exec qrouter-1306cecd-d55e-4a90-a9af-96be92779a1b tcpdump -i qg-dbeca7ef-4c icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on qg-dbeca7ef-4c, link-type EN10MB (Ethernet), capture size 65535 bytes
00:15:37.305216 IP 10.157.8.162 > RackA_control_server-1: ICMP echo request, id 39434, seq 2222, length 64
00:15:38.307587 IP 10.157.8.162 > RackA_control_server-1: ICMP echo request, id 39434, seq 2223, length 64
00:15:39.312015 IP 10.157.8.162 > RackA_control_server-1: ICMP echo request, id 39434, seq 2224, length 64

this is how my router namespace iptables looks ... (more)