{"action":"created","issue":{"url":"https://api.github.com/repos/projectcalico/felix/issues/1838","repository_url":"https://api.github.com/repos/projectcalico/felix","labels_url":"https://api.github.com/repos/projectcalico/felix/issues/1838/labels{/name}","comments_url":"https://api.github.com/repos/projectcalico/felix/issues/1838/comments","events_url":"https://api.github.com/repos/projectcalico/felix/issues/1838/events","html_url":"https://github.com/projectcalico/felix/pull/1838","id":332442646,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk0OTI0Mzc1","number":1838,"title":"Add option to specify port-range for outgoing NAT.","user":{"login":"databus23","id":439223,"node_id":"MDQ6VXNlcjQzOTIyMw==","avatar_url":"https://avatars1.githubusercontent.com/u/439223?v=4","gravatar_id":"","url":"https://api.github.com/users/databus23","html_url":"https://github.com/databus23","followers_url":"https://api.github.com/users/databus23/followers","following_url":"https://api.github.com/users/databus23/following{/other_user}","gists_url":"https://api.github.com/users/databus23/gists{/gist_id}","starred_url":"https://api.github.com/users/databus23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/databus23/subscriptions","organizations_url":"https://api.github.com/users/databus23/orgs","repos_url":"https://api.github.com/users/databus23/repos","events_url":"https://api.github.com/users/databus23/events{/privacy}","received_events_url":"https://api.github.com/users/databus23/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-14T15:03:23Z","updated_at":"2018-06-22T13:03:08Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/projectcalico/felix/pulls/1838","html_url":"https://github.com/projectcalico/felix/pull/1838","diff_url":"https://github.com/projectcalico/felix/pull/1838.diff","patch_url":"https://github.com/projectcalico/felix/pull/1838.patch"},"body":"This commit allow to optionally specify a port range for the outgoing NAT rules that are created by felix.\r\n\r\n## Description\r\nThis option allows to specify the port range used by iptables for outgoing NAT (e.g. `MASQUERADE`). We are running calico on a VMware based OpenStack with security groups implemented by a stateless firewall (VMware distributed virtual switch, DVS). This imposes some limitations how `egress` rules are implemented. In fact we need to ensure that outgoing traffic is coming from the default ephemeral port range (32768-65535). This works fine for traffic initiated by processes from the host network but breaks for the default masquerading case. The reason being that iptables picks arbitrary ports to resolve port collisions by default.\r\n\r\nI realise that this is a rather exotic issue but the proposed configuration change is rather generic and fully optional.\r\nI'm hoping to get this merged so that we can use upstream calico in our stack.  Would this change be generally acceptable to you?\r\n\r\n## Todos\r\n- [x] Unit tests (full coverage)\r\n- [x] Documentation\r\n- [ ] Release note\r\n\r\n## Release Note\r\n<!-- Writing a release note:\r\n- By default, no release note action is required.\r\n- If you're unsure whether or not your PR needs a note, ask your reviewer for guidance.\r\n- If this PR requires a release note, update the block below to include a concise note describing\r\n  the change and any important impacts this PR may have.\r\n-->\r\n\r\n```release-note\r\nNone required\r\n```"},"comment":{"url":"https://api.github.com/repos/projectcalico/felix/issues/comments/399435223","html_url":"https://github.com/projectcalico/felix/pull/1838#issuecomment-399435223","issue_url":"https://api.github.com/repos/projectcalico/felix/issues/1838","id":399435223,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTQzNTIyMw==","user":{"login":"fasaxc","id":469264,"node_id":"MDQ6VXNlcjQ2OTI2NA==","avatar_url":"https://avatars0.githubusercontent.com/u/469264?v=4","gravatar_id":"","url":"https://api.github.com/users/fasaxc","html_url":"https://github.com/fasaxc","followers_url":"https://api.github.com/users/fasaxc/followers","following_url":"https://api.github.com/users/fasaxc/following{/other_user}","gists_url":"https://api.github.com/users/fasaxc/gists{/gist_id}","starred_url":"https://api.github.com/users/fasaxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasaxc/subscriptions","organizations_url":"https://api.github.com/users/fasaxc/orgs","repos_url":"https://api.github.com/users/fasaxc/repos","events_url":"https://api.github.com/users/fasaxc/events{/privacy}","received_events_url":"https://api.github.com/users/fasaxc/received_events","type":"User","site_admin":false},"created_at":"2018-06-22T13:03:08Z","updated_at":"2018-06-22T13:03:08Z","author_association":"MEMBER","body":"libcalico-go PR: https://github.com/projectcalico/libcalico-go/pull/893"}}
{"actor":{"display_login":"fasaxc"}}