What needs to happen
The gateway claims a dedicated public address as the source that tenant egress traffic is masqueraded to. Every packet arriving for that address is claimed by the gateway program, and anything that is not TCP or UDP is dropped rather than handed to the kernel stack. That mirrors the fail closed choice already made for the gateway's own internal reachability address.
The stakes are not the same. The masquerade address is reachable from the entire internet, and the internet sends more than TCP and UDP to it. Path MTU discovery messages, destination unreachable, time exceeded, and echo replies all arrive as ICMP, and all of them are dropped today.
Desired outcome: decide which of these the return path should translate back to the tenant that originated the flow, and pass or handle the rest rather than dropping every one of them.
Why this matters
Path MTU discovery is the one with teeth. A tenant connection that crosses a smaller link somewhere on the internet stalls instead of adapting, and the failure presents as a hang rather than an error, on large transfers only, intermittently. That is close to the hardest class of network problem to attribute back to its cause.
Echo replies being dropped means the simplest reachability check a tenant can run from inside their own workload never works, which will read as a broken network long before anyone suspects the gateway.
This was called out by the author when the datapath was written, so it is a known deferral rather than an oversight, but nothing tracked it.
What needs to happen
The gateway claims a dedicated public address as the source that tenant egress traffic is masqueraded to. Every packet arriving for that address is claimed by the gateway program, and anything that is not TCP or UDP is dropped rather than handed to the kernel stack. That mirrors the fail closed choice already made for the gateway's own internal reachability address.
The stakes are not the same. The masquerade address is reachable from the entire internet, and the internet sends more than TCP and UDP to it. Path MTU discovery messages, destination unreachable, time exceeded, and echo replies all arrive as ICMP, and all of them are dropped today.
Desired outcome: decide which of these the return path should translate back to the tenant that originated the flow, and pass or handle the rest rather than dropping every one of them.
Why this matters
Path MTU discovery is the one with teeth. A tenant connection that crosses a smaller link somewhere on the internet stalls instead of adapting, and the failure presents as a hang rather than an error, on large transfers only, intermittently. That is close to the hardest class of network problem to attribute back to its cause.
Echo replies being dropped means the simplest reachability check a tenant can run from inside their own workload never works, which will read as a broken network long before anyone suspects the gateway.
This was called out by the author when the datapath was written, so it is a known deferral rather than an oversight, but nothing tracked it.