oxidecomputer / oxidecomputer/opte

Allow/support arbitrary L4 protocols in guest traffic

Open
#609 0 comments 0 reactions 1 assignee View on GitHub

@taspelund is already working on this.

Since Mar 26, 2025.

customer
Dominant language
Rust
Stars
77
Forks
11
Avg merge
9d 20h
Merged PRs (30d)
8

Description

OPTE currently rejects traffic that doesn't match one of 4 permitted L4 protocols: TCP, UDP, ICMP and ICMPv6.

While there are NAT considerations for other L4 protocols (Shared NAT / PAT / NAT Overload / rely on TCP/UDP source/destination ports as part of the NAT entry, so it's only compatible with 1:1 NAT), this is restrictive for users who need to rely on other transport protocols.

e.g.

Keepalived uses VRRP to signal state transitions (must be unicast on our platform), but since this rides inside its own L4 Protocol, those packets get dropped by OPTE.

Simple tunneling mechanisms like GRE or IP-in-IP rely on L4 protocols that are not TCP, UDP or ICMP.

In these situations, the narrow L4 protocol support is a hindrance... where at best the experience is functional but kludgy (like having to setup something like wireguard as transport).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.