github-actions[bot] commented on issue #14547: URL: https://github.com/apache/cloudstack/issues/14547#issuecomment-6580447015
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/41453262605) for details. > > </details> ## 🎯 Triage report Remote access VPN clients on a VPC cannot get replies from LB rules or from the router's public IPs. The per-NIC routing tables (`Table_<dev>`) add throw routes for tier networks but none for the VPN client range, so replies leave via the public gateway instead of the client's ppp interface. Port forwards work because the reply is routed after reverse NAT. The reporter's proposed fix adds a throw for the client range to each per-NIC table, plus an anti-spoofing drop for client-sourced traffic not arriving on `ppp+`. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | Routing defect; the report says the same code exists in 4.20 too, so it is not a regression | | **Component** | component:virtual-router | Routing tables built in `CsAddress.py` / `CsRoute.py` on the VR | | **Severity** | Severity:Major | LB rules and router public IPs are unreachable over VPN; port forwards work as a workaround | | **Labels** | type:bug, component:virtual-router, component:vpc, Severity:Major | | | **Coding agent** | Needs more info | Fix direction is clear, but maintainers must decide on the anti-spoofing rule and whether isolated networks are affected (untested) | ### 🔗 Similar issues - #14545 (related) — remote access VPN clients disconnected by VR config passes; same feature, different defect - #7282 (related) — remote access VPN cannot connect <details> <summary>💡 Notes and suggestions</summary> - Reproduction is in the report: VPC, LB rule on a second public network, connected L2TP client, then `curl` to the LB and `tcpdump` on the router. - Check the isolated-network case the reporter flagged as untested. - Consider whether the anti-spoofing drop could affect legitimate traffic on `ppp+` before merging. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/41453262605) · copilot · haiku55 · \~2 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 41453262605, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/41453262605 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"41453262605","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/41453262605","publishing_job":{"key":"safe_outputs","check_run_id":"125350399070"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
