From d1ad96e629281111433ee5aad5e44fc08ca581a0 Mon Sep 17 00:00:00 2001 From: waterWang Date: Fri, 21 Aug 2026 18:29:12 +0800 Subject: [PATCH] fix: scope VPC SNAT rule to exclude locally-generated packets (#13942) On a VPC with public IPs from more than one range/VLAN, the virtual router installs an unscoped source NAT rule on every public interface using the single VPC source NAT address. Because the rule has no source match, it also rewrites traffic the router itself originates, so the VR cannot emit packets with the correct source address from any public interface other than the source-NAT one. Fix: add `-m addrtype ! --src-type LOCAL` to the elif SNAT rule so it only matches forwarded (guest) traffic, not locally-generated packets. Closes: #13942 --- systemvm/debian/opt/cloud/bin/cs/CsAddress.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) mode change 100755 => 100644 systemvm/debian/opt/cloud/bin/cs/CsAddress.py diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py old mode 100755 new mode 100644 index fe95808f7d32..72e196e67238 --- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py @@ -889,7 +889,7 @@ def post_config_change(self, method): ["nat", "", "-A POSTROUTING -j SNAT -o %s --to-source %s" % (self.dev, self.address['public_ip'])]) elif cmdline.get_source_nat_ip() and not self.is_private_gateway(): self.fw.append( - ["nat", "", "-A POSTROUTING -j SNAT -o %s --to-source %s" % (self.dev, cmdline.get_source_nat_ip())]) + ["nat", "", "-A POSTROUTING -m addrtype ! --src-type LOCAL -j SNAT -o %s --to-source %s" % (self.dev, cmdline.get_source_nat_ip())]) def list(self): self.iplist = {}