How to assure that floating IP is taken as source address for egress traffic of VM

Joachim

3/15/23, 2:57 PM

If I have a OpenStack VM which has a configured a floating IP address and tries to connect to a service outside the OpenStack "universe". How do I assure, that the source IP address of this connection is the floating IP address of this VM? The background of this question is that we have restrictive firewall rules (sure) and only want to allow egress traffic from the VM (i.e a Jenkins which builds software and wants them to distribute it directly to an outbound service via SSH) to external machines.

In the words of networking this seems not to be possible because on the VM I have no network interface which is connected to this network where the floating IP belongs to, and therfore I don't have a dedicated route via the default router of the floating IP to the external network. I can't take the (fixed) IP address of the VM because these IP addresses are invisible and private to the outside world. We use SNAT on the routers to go outside. Problem is that all VMs take the same router to connect to outside so the source IP address would be the same for all VMs. But I need a different source IP address to be able to implement firewall rules.

I hope I could explain my problem sufficiently.

Thanks! Joachim.

0 + 0

openstack

openstack-neutron

Bob

3/15/23, 4:19 PM

Talk to your OpenStack administrator. You may have the option to use an additional/ another network for your instance, with a routable IP-address range rather than your private project network. Then you won't have to use floating IP-address (which is intended for incoming traffic) and can have a unique dedicated IP-address for egress traffic.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to assure that floating IP is taken as source address for egress traffic of VM

TH: จะมั่นใจได้อย่างไรว่า IP แบบลอยตัวถูกใช้เป็นที่อยู่ต้นทางสำหรับการรับส่งข้อมูลขาออกของ VM

RO: Cum să vă asigurați că IP-ul plutitor este luat ca adresă sursă pentru traficul de ieșire al VM

RU: Как убедиться, что плавающий IP-адрес используется в качестве исходного адреса для исходящего трафика виртуальной машины

VI: Làm cách nào để đảm bảo rằng IP nổi được lấy làm địa chỉ nguồn cho lưu lượng đi ra của VM

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.