[Bug 2051935] Related fix merged to neutron (master)

[OpenStack Infra]

Reviewed:  https://review.opendev.org/c/openstack/neutron/+/987308
Committed: https://opendev.org/openstack/neutron/commit/782b07dc60eeaf44d46609b506adfa541934eb8f
Submitter: "Zuul (22348)"
Branch:    master

commit 782b07dc60eeaf44d46609b506adfa541934eb8f
Author: Brian Haley <haleyb.dev at gmail.com>
Date:   Mon May 4 18:56:58 2026 -0400

    Change ovn_router_indirect_snat config option to True
    
    This option was introduced in the 2024.2 cycle and backported
    to 2024.1. As the default version of OVN has advanced past
    the v24.03.4 requirement, lets change the default to be
    True and mark it as deprecated so OVN matches the other
    back-ends in how it behaves wrt SNAT.
    
    Updated tests as needed.
    
    Related-bug: #2051935
    
    Change-Id: Ic76f78547ec4b910b87ad8dbc1c34110c027a755
    Signed-off-by: Brian Haley <haleyb.dev at gmail.com>

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/2051935

Title:
  [OVN] SNAT only happens for subnets directly connected to a router

Status in OpenStack Neutron API OVN Plugin Charm:
  New
Status in neutron:
  Fix Released
Status in neutron package in Ubuntu:
  New

Bug description:
  I am trying to achieve the following scenario:

  I have a VM attached to a router w/o external gateway (called project-
  router) but with a default route which send all the traffic to another
  router (transit router) which has an external gateway with snat
  enabled and it is connected to a transit network 192.168.100.0/24

  My VM is  on 172.16.100.0/24, traffic hits the project-router thanks
  to the default route gets redirected to the transit-router correctly,
  here it gets into the external gateway but w/o being snat.

  This is because in ovn I see that SNAT on this router is only enabled
  for logical ip in 192.168.100.0/24 which is the subnet directly
  connected to the router

  # ovn-nbctl lr-nat-list neutron-6d1e6bb7-3949-43d1-8dac-dc55155b9ad8
  TYPE             EXTERNAL_IP        EXTERNAL_PORT    LOGICAL_IP            EXTERNAL_MAC         LOGICAL_PORT
  snat             147.22.16.207                       192.168.100.0/24

  But I would like that this router snat all the traffic that hits it,
  even when coming from a subnet not directly connected to it.

  I can achieve this by setting in ovn the snat for 0.0.0.0/0

  # ovn-nbctl lr-nat-add neutron-6d1e6bb7-3949-43d1-8dac-dc55155b9ad8
  snat 147.22.16.207 0.0.0.0/0

  # ovn-nbctl lr-nat-list neutron-6d1e6bb7-3949-43d1-8dac-dc55155b9ad8
  TYPE             EXTERNAL_IP        EXTERNAL_PORT    LOGICAL_IP            EXTERNAL_MAC         LOGICAL_PORT
  snat             147.22.16.207                       0.0.0.0/0
  snat             147.22.16.207                       192.168.100.0/24

  But this workaround can be wiped if I run the neutron-ovn-db-sync-util
  on any of the neutron-api unit.

  Is there a way to achieve this via OpenStack? If not does it make
  sense to have this as a new feature?

To manage notifications about this bug go to:
https://bugs.launchpad.net/charm-neutron-api-plugin-ovn/+bug/2051935/+subscriptions