Distributed network address translation for efficient cloud service access
A method for coordinating distributed network address translation (NAT) in a network within which several logical networks are implemented. The logical networks include several tenant logical networks and at least one service logical network that include service virtual machines (VMs) that are accessed by VMs of the tenant logical networks. The method defines a group of replacement IP address and port number pairs. Each pair is used to uniquely identify a VM across all tenant logical networks. The method sends to at least one host that is hosting a VM of a particular tenant logical network, a set of replacement IP address and port number pairs. Each replacement IP address and port number pair can be used by the host to replace a source IP address and a source port number in a packet that is destined from the particular VM to a VM of the particular service logical network.
1. For a multi-tenant datacenter, a method of forwarding packets from tenant machines executing on a host computer to a set of service machines, the method comprising:
at the host computer:
receiving a packet sent by a particular machine of a particular tenant, the particular machine executing on the host computer in the multi-tenant datacenter;
determining that the packet is directed to a service machine, wherein the service machine receives and processes packets from machines in the multi-tenant datacenter belonging to a plurality of different tenants, wherein at least two of the tenants have machines with overlapping network addresses;
based on the determination that the packet is directed to the service machine, replacing in a header of the packet a first network address and port number pair identified as a source network address and port number pair with a second network address and port number pair selected from a plurality of replacement network address and port number pairs maintained by a set of controllers and provided to the host computer, the first network address and port number pair associated with the particular machine of the particular tenant and the second network address and port number pair used to ensure that the service machine is able to differentiate between machines of different tenants with overlapping network addresses; and
forwarding the packet with the second network address and port number pair to the service machine.
2. The method of claim 1 , wherein the packet is a first packet and the particular machine is a first machine of a first tenant, wherein the method further comprises, at the host computer:
receiving a second packet sent by a second machine of a second tenant, the second machine also executing on the host computer;
determining that the second packet is directed to the same service machine;
based on the determination that the second packet is directed to the service machine, replacing in a header of the packet a third network address and port number pair identified as a source network address and port number pair with a fourth network address and port number pair, the third network address and port number pair associated with the second machine of the second tenant and the fourth network address and port number pair used to ensure that the service machine is able to differentiate between machines of different tenants with overlapping network addresses; and
forwarding the second packet with the fourth network address and port number pair to the service machine.
3. The method of claim 2 , wherein the first and third network addresses and port number pairs are the same network address and port number pairs.
4. The method of claim 2 , wherein a first logical network is defined for the first tenant and a second logical network is defined for the second tenant, wherein the first and second logical networks have overlapping network address spaces.
5. The method of claim 1 , wherein the second network address and port number pair uniquely identifies the first machine for the service machine.
6. The method of claim 1 further comprising, at the host computer:
receiving a reply packet from the service machine, the reply packet having the second network address and port number pair as a destination network address and port number pair;
replacing the second network address and port number pair in the reply packet with the first network address and port number pair; and
delivering the reply packet with the first network address and port number pair to the particular machine.
7. The method of claim 1 , wherein the service machine is one of a plurality of service machines in the multi-tenant datacenter accessible to the particular machine for performing a particular service.
8. The method of claim 1 , wherein the packet header comprises a destination media access control (MAC) address of a gateway for the particular machine, the method further comprising replacing in the packet header the MAC address of the gateway with a MAC address of the service machine to prevent the packet from being forwarded to the gateway.
9. A non-transitory machine-readable medium storing a program which when executed by at least one processing unit of a host computer in a multi-tenant datacenter forwards packets from tenant machines executing on the host computer to a set of service machines, the program comprising sets of instructions for:
receiving a packet sent by a particular machine of a particular tenant, the particular machine executing on the host computer in the multi-tenant datacenter;
determining that the packet is directed to a service machine, wherein the service machine receives and processes packets from machines in the multi-tenant datacenter belonging to a plurality of different tenants, wherein at least two of the tenants have machines with overlapping network addresses;
based on the determination that the packet is directed to the service machine, replacing in a header of the packet a first network address and port number pair identified as a source network address and port number pair with a second network address and port number pair selected from a plurality of replacement network address and port number pairs maintained by a set of controllers and provided to the host computer, the first network address and port number pair associated with the particular machine of the particular tenant and the second network address and port number pair used to ensure that the service machine is able to differentiate between machines of different tenants with overlapping network addresses; and
forwarding the packet with the second network address and port number pair to the service machine.
10. The non-transitory machine-readable medium of claim 9 , wherein the packet is a first packet and the particular machine is a first machine of a first tenant, wherein the program further comprises sets of instructions for:
receiving a second packet sent by a second machine of a second tenant, the second machine also executing on the host computer;
determining that the second packet is directed to the same service machine;
based on the determination that the second packet is directed to the service machine, replacing in a header of the packet a third network address and port number pair identified as a source network address and port number pair with a fourth network address and port number pair, the third network address and port number pair associated with the second machine of the second tenant and the fourth network address and port number pair used to ensure that the service machine is able to differentiate between machines of different tenants with overlapping network addresses; and
forwarding the second packet with the fourth network address to the service machine.
11. The non-transitory machine-readable medium of claim 10 , wherein the first and third network addresses and port number pairs are the same network address and port number pairs.
12. The non-transitory machine-readable medium of claim 10 , wherein a first logical network is defined for the first tenant and a second logical network is defined for the second tenant, wherein the first and second logical networks have overlapping network address spaces.
13. The non-transitory machine-readable medium of claim 9 , wherein the second network address and port number pair uniquely identifies the first machine for the service machine.
14. The non-transitory machine-readable medium of claim 9 , wherein the program further comprises sets of instructions for:
receiving a reply packet from the service machine, the reply packet having the second network address and port number pair as a destination network address and port number pair;
replacing the second network address and port number pair in the reply packet with the first network address and port number pair; and
delivering the reply packet with the first network address and port number pair to the particular machine.
15. The non-transitory machine-readable medium of claim 9 , wherein the service machine is one of a plurality of service machines in the multi-tenant datacenter accessible to the particular machine for performing a particular service.
16. The non-transitory machine-readable medium of claim 9 , wherein the packet header comprises a destination media access control (MAC) address of a gateway for the particular machine, the program further comprising a set of instructions for replacing in the packet header the MAC address of the gateway with a MAC address of the service machine to prevent the packet from being forwarded to the gateway.
17. The method of claim 1 , wherein the service machine executes on the host computer.
18. The method of claim 1 , wherein the host computer is a first host computer, wherein the service machine executes on a different second host computer.