Do not NAT traffic to cloud-private
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	taavi
	Feb 7 2024, 8:55 AM

Description

Traffic from Cloud VPS instances to the cloud-private networks should not be subjected to the general egress NAT.

Subject	Repo	Branch	Lines +/-
Remove cloud_private_v4_set from cloudgw nftables definition	operations/puppet	production	+2 -13
P:wmcs::cloudgw: do not NAT traffic to cloud-internal networks	operations/puppet	production	+39 -13
P:wmcs: cloud_private_subnet: add route to private instance networks	operations/puppet	production	+63 -8

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 7 2024, 8:55 AM

Change 998261 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:wmcs: cloud_private_subnet: add route to private instance networks

Change 998261 merged by Majavah:

[operations/puppet@production] P:wmcs: cloud_private_subnet: add route to private instance networks

Change 998412 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:wmcs::cloudgw: do not traffic to cloud-internal networks

taavi triaged this task as Medium priority.Feb 7 2024, 2:46 PM

Change 998412 merged by Majavah:

[operations/puppet@production] P:wmcs::cloudgw: do not NAT traffic to cloud-internal networks

Mentioned in SAL (#wikimedia-cloud) [2024-02-08T13:43:02Z] <taavi> deploy change to exclude cloud-private networks from general egress NAT https://phabricator.wikimedia.org/T356850

taavi closed this task as Resolved.Feb 8 2024, 1:47 PM

Change 999004 had a related patch set uploaded (by Cathal Mooney; author: Cathal Mooney):

[operations/puppet@production] Remove cloud_private_v4_set from cloudgw nftables definition

Change 999004 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] Remove cloud_private_v4_set from cloudgw nftables definition