Mailing List Archive

intentionally allow ip "spoofing"?
Hi folks,

(Resending, since I did something wrong with the subject last time...)

I wonder if there is a way to intentionally allow ip "spoofing" for certain

The use case is the following. We have two DCs, both have openstack
deployed. One tenant lives on both DCs, say in DC1 and in DC2.

Now the tenant wants the VMs in two DCs to talk to each other with private
IPs... The way I am trying to achieve this is to run OpenSwan in one VM on
each side, build an IPSEC tunnel enabling lan2lan.

But, this requires: 1) all VMs add a static route, routing packets to the
other site to the local openswan box; 2) the openswan box can send out
packets with src IP other than itself.

1) is easy to solve, but I am stuck on 2)...

I found that there is a filterref in libvirt.xml in every VM:
<filterref filter="nova-instance-instance-00000007-fa163e254a1b">
<parameter name="IP" value=""/>
<parameter name="DHCPSERVER" value=""/>
<parameter name="PROJNET" value=""/>
<parameter name="PROJMASK" value=""/>

which I believe is dropping outgoing packets that don't src from

I removed that "IP" parameter, and added "CTRL_IP_LEARNING"="dhcp", but
cloud-init no longer works...

Any ideas?