[feature request] `portmap` support `masquerade-all` option

[BSWANG]

When k8s cluster use ipvlan L3/L2, macvlan or other underlay network plugin. The traffic come back from pod to host maybe not go through conntrack in host, and can not un-snat to hostip which client requested.

Masquerad all traffic can make sure the pod reply come back to host and go through conntrack in host.

[mccv1r0]

I'm having trouble understanding what is going on.

What addresses live where?

[dcbw]

@BSWANG can you clarify the diagram? What are 1.1.1.1 and 2.2.2.2?

Is the square a node in a cluster? And is 192.168.0.1 and 0.2 NICs on the node?

Is 10.0.0.1 the container?

[dcbw]

In your use-case, what is the source-ip and dest-ip of the incoming packet from client -> pod?

When the pod replies, what is the source-ip and dest-ip of hte outgoing packet?

[MikeZappa87]

Are you able to give the output of 'ip r' on the host node?

[BSWANG]

@dcbw @MikeZappa87 Thanks for reply. I have updated the description, for some underlay plugins scenarios.