Add outbound_addr to allow for SNAT instead of MASQ

[lto-dev]

Added outbound_addr to the bridge driver.

I created a bridge-snat plugin to use this feature and do SNAT instead of MASQUERADE on certain networks since i have multiple public ip's on same machine and i needed the traffic to go out on them and not on the gateway. I can share the plugin as well if anyone wants it.

[lto-dev]

let me know if the modifications are ok

[Luap99]

Note I do not have time to properly review the rules right now. However please make sure your commits make sense as individual unit. Currently they are pretty meaningless so I suggest you squash everything into one

[packit-as-a-service[bot]]

Ephemeral COPR build failed. @containers/packit-build please check.

[mheon]

For firewalld, this would force all of our NAT to be through rich rules, as the standard port-forwarding rules don't allow for this. Would be a pretty significant change if we wanted to make it.

[Luap99]

For firewalld, this would force all of our NAT to be through rich rules, as the standard port-forwarding rules don't allow for this. Would be a pretty significant change if we wanted to make it.

I guess we should throw an error if firewalld is used with this option. Given the likely low usage of firewalld users I don't think we need to implement this right now for this PR then.

[lto-dev]

Should we not have two options then one for ipv4_outbound address and one for ipv6_outbound address instead then?

I was trying to mimic some of the docker behavior, i use ipv4. I'll have to take a look into ipv6 snat for this if you decide you want it. When i started the pr i was reading ipv6 nat is discouraged so i didn't approach it.

it looks like their bridge supports ipv6...or not, documentation is kinda conflicting com.docker.network.bridge.host_binding_ipv4 | all IPv4 and IPv6 addresses | Default IP when binding container ports.

let me know if you want it and what names to use for it

[Luap99]

I think for consistency it makes sense to have it assuming kernel wise is basically the same rule with ipv6? If it turns out to be more complicated then I am fine with leaving it.

Naming wise I think outbound_addr4 and outbound_addr6 maybe?

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lto-dev, Luap99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ~~OWNERS~~ [Luap99]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[baude]

/lgtm

[baude]

LGTN