Hi,
I am using nova-network + VlanNetworkManage in Havana (2013.2.2). But I
meet
following issue.
Different tenants can ping each other using fixed ip. I also found a bug
fixed
commit[1] about this. But it seems not work very well. It add following
rule to the
iptables. (bond1 is the public_interface)
-A nova-network-FORWARD -i br1000 -o br1000 -j ACCEPT
-A nova-network-FORWARD -i br1000 -o bond1 -j ACCEPT
-A nova-network-FORWARD -i br1000 -j DROP
-A nova-network-FORWARD -o br1000 -j DROP
-A nova-network-FORWARD -i br1001 -o br1001 -j ACCEPT
-A nova-network-FORWARD -i br1001 -o bond1 -j ACCEPT
-A nova-network-FORWARD -i br1001 -j DROP
-A nova-network-FORWARD -o br1001 -j DROP
It means drop the packages from br1000(tenant A) to br1001(tenant B). But I
still
catch the package from br1000 to br1001 when using ping command.
$ tcpdump -i br1000 -l -ne icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on br1000, link-type EN10MB (Ethernet), capture size 65535
bytes
22:30:46.541275 fa:16:3e:ef:45:75 > fa:16:3e:be:bf:f6, ethertype IPv4
(0x0800), length 98: 10.192.1.13 > 10.192.2.18: ICMP echo request, id 2690,
seq 501, length 64
22:30:46.541599 fa:16:3e:be:bf:f6 > fa:16:3e:ef:45:75, ethertype IPv4
(0x0800), length 98: 10.192.2.18 > 10.192.1.13: ICMP echo reply, id 2690,
seq 501, length 64
$ tcpdump -i br1001 -l -ne icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on br1001, link-type EN10MB (Ethernet), capture size 65535
bytes
22:31:11.540675 fa:16:3e:b8:92:e6 > fa:16:3e:96:d9:18, ethertype IPv4
(0x0800), length 98: 10.192.1.13 > 10.192.2.18: ICMP echo request, id 2690,
seq 526, length 64
22:31:11.540937 fa:16:3e:96:d9:18 > fa:16:3e:b8:92:e6, ethertype IPv4
(0x0800), length 98: 10.192.2.18 > 10.192.1.13: ICMP echo reply, id 2690,
seq 526, length 64
Does anybody can explain and tell me how to fix it?
[1] https://review.openstack.org/#/c/20362/
--
Lei Zhang
Blog: http://xcodest.me
twitter/weibo: @jeffrey4l
_______________________________________________
Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to : openstack@lists.openstack.org
Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
