Want temporary hack to support inbound connections to guest #167
Description
Currently, without the integration of Boundary Services, there is no way for someone to get SSH access into a guest instance (created by Omicron). I was tasked with finding a way to make this work for the interim while we wait for Boundary Services to come into the fold.
The idea behind the hack is to have a global flag in xde.conf that when set will modify the behavior of xde/OPTE in such a way that:
- It will no longer perform IPv6/Geneve encap.
- It will hijack the SNAT config and treat it as an "external" IP configuration, performing 1:1 NAT with said IP.
- The
arplayer will Proxy ARP for this external IP, allowing other hosts on the same local (physical) IPv4 network to discover this external IP.
In effect, this allows one to SSH to the guest via some IP that sits in their local IPv4 network.
This hack will not provide outbound access from the guest instance. That can be done, but it requires more work, and the idea is for this hack to have the shortest life possible, being immediately undone the moment Boundary Services is integrated into the typical Omicron deployment.