)]}'
{"manifests/masquerade_networks.pp":[{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"55db0989c6f50f50ad3754b52cc7bc4853e768c6","unresolved":false,"context_lines":[{"line_number":55,"context_line":"          \u0027state\u0027       \u003d\u003e [\u0027ESTABLISHED\u0027, \u0027NEW\u0027, \u0027RELATED\u0027],"},{"line_number":56,"context_line":"        },"},{"line_number":57,"context_line":"        \"140 routed_network forward destinations ${source}\" \u003d\u003e {"},{"line_number":58,"context_line":"          \u0027destination\u0027 \u003d\u003e $source,"},{"line_number":59,"context_line":"          \u0027chain\u0027       \u003d\u003e \u0027FORWARD\u0027,"},{"line_number":60,"context_line":"          \u0027proto\u0027       \u003d\u003e \u0027all\u0027,"},{"line_number":61,"context_line":"          \u0027state\u0027       \u003d\u003e [\u0027ESTABLISHED\u0027, \u0027NEW\u0027, \u0027RELATED\u0027],"}],"source_content_type":"text/x-puppet","patch_set":3,"id":"3f79a3b5_a792e248","line":58,"range":{"start_line":58,"start_character":11,"end_line":58,"end_character":34},"updated":"2018-10-15 14:45:11.000000000","message":"this does not look very intuitive...","commit_id":"a25ff449dd6bfce48259c643d92ed4cce679e283"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"8bec85d162f0c1f06b422743d9a662ac995583a4","unresolved":false,"context_lines":[{"line_number":55,"context_line":"          \u0027state\u0027       \u003d\u003e [\u0027ESTABLISHED\u0027, \u0027NEW\u0027, \u0027RELATED\u0027],"},{"line_number":56,"context_line":"        },"},{"line_number":57,"context_line":"        \"140 routed_network forward destinations ${source}\" \u003d\u003e {"},{"line_number":58,"context_line":"          \u0027destination\u0027 \u003d\u003e $source,"},{"line_number":59,"context_line":"          \u0027chain\u0027       \u003d\u003e \u0027FORWARD\u0027,"},{"line_number":60,"context_line":"          \u0027proto\u0027       \u003d\u003e \u0027all\u0027,"},{"line_number":61,"context_line":"          \u0027state\u0027       \u003d\u003e [\u0027ESTABLISHED\u0027, \u0027NEW\u0027, \u0027RELATED\u0027],"}],"source_content_type":"text/x-puppet","patch_set":3,"id":"3f79a3b5_74f6abda","line":58,"range":{"start_line":58,"start_character":11,"end_line":58,"end_character":34},"in_reply_to":"3f79a3b5_a792e248","updated":"2018-10-15 22:00:27.000000000","message":"We need to:\n  Forward traffic from the source network.\n  Forward traffic to the source network.\n\n make sense?\n\nHowever, now that I think about it ...\n\nActually we probably also should:\n Forward traffic from the destination networks.\n Forward traffic to the destination networks.\n\nThe last one we only do if all destination networks are also source networks. This is typically is the case when the undercloud uses the service, however it is possible to configure the undercloud differently. I.e we can tell the undercloud to only masquerade 2 out of 3 subnets. We then end up with:\n\n  MasqueradeNetworks:\n    172.20.0.0/26:\n    - 172.20.0.0/26\n    - 172.20.0.64/26\n    - 172.20.0.128/26\n    172.20.0.64/26:\n    - 172.20.0.0/26\n    - 172.20.0.64/26\n    - 172.20.0.128/26\n\nWe would end up with return rules for 172.20.0.128/26, but no traffic to/from the 172.20.0.128/26 might not ever get to POSTROUTING since there is no ACCEPT rules in the FORWARD chain for this network:\n\n Example:\nChain POSTROUTING (policy ACCEPT)\ntarget     prot opt source               destination         \nRETURN     all  --  172.20.0.0/26        172.20.0.0/26        state NEW,RELATED,ESTABLISHED\nRETURN     all  --  172.20.0.0/26        172.20.0.128/26      state NEW,RELATED,ESTABLISHED\nRETURN     all  --  172.20.0.0/26        172.20.0.64/26       state NEW,RELATED,ESTABLISHED\nRETURN     all  --  172.20.0.64/26       172.20.0.0/26        state NEW,RELATED,ESTABLISHED\nRETURN     all  --  172.20.0.64/26       172.20.0.128/26      state NEW,RELATED,ESTABLISHED\nRETURN     all  --  172.20.0.64/26       172.20.0.64/26       state NEW,RELATED,ESTABLISHED\nMASQUERADE  all  --  172.20.0.0/26        anywhere             state NEW,RELATED,ESTABLISHED\nMASQUERADE  all  --  172.20.0.64/26       anywhere             state NEW,RELATED,ESTABLISHED\n\nChain FORWARD (policy ACCEPT)\ntarget     prot opt source               destination         \nACCEPT     all  --  172.20.0.0/26        anywhere             state NEW,RELATED,ESTABLISHED\nACCEPT     all  --  172.20.0.64/26       anywhere             state NEW,RELATED,ESTABLISHED\nACCEPT     all  --  anywhere             172.20.0.0/26        state NEW,RELATED,ESTABLISHED\nACCEPT     all  --  anywhere             172.20.0.64/26       state NEW,RELATED,ESTABLISHED\n\n... but since the default policy is ACCEPT on UC it would work anyway (?)","commit_id":"a25ff449dd6bfce48259c643d92ed4cce679e283"}]}