I'm using OpenStack and OVS. This is my case:
- From a remote host, I ping VM with IP A.
- Local gateway received the echo request, then send a packet with IP A and MAC address A' (based on a fixed IP-MAC map on gateway)
- The virtual router on host machine (with MAC address R) somehow receive the packet on its external interface. I checked it by tcpdump.
- On the virtual router, there are NAT rules to translate address A to internal address 192.168.100.40:
Chain neutron-l3-agent-PREROUTING (1 references)
target prot opt source destination DNAT all -- anywhere 18.104.22.168 to:192.168.100.43 DNAT all -- anywhere 22.214.171.124 to:192.168.100.40
But the problem is those rules are never hit. I checked it with
iptables -t nat -L -v -n
and found out hit count of these rule = 0.
I don't know how can I debug this case. Is it because MAC address is different from router's MAC that packets are dropped? If yes, why tcpdump shows message.
If it passed MAC address check, why those packets didn't hit iptables rules. How can I debug this case?