If anyone had similiar problem; CentOS 6 have retarded default settings in /etc/sysctl.conf that disable iptables on bridges, change it to
net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-arptables = 1 and it will work On Mon, 25 Aug 2014 11:05:45 +0200, Mariusz Gronczewski <mariusz.gronczew...@efigence.com> wrote: > Hi, > > I've managed to set up every other component, but neutron security > groups dont want to work. I have connectivity between all machines but > nothing ever hits iptables rules. > > I see that on compute nodes I get correct firewall rules: > > :neutron-openvswi-ic2c7ef23-2 - [0:0] > :neutron-openvswi-oc2c7ef23-2 - [0:0] > :neutron-openvswi-sc2c7ef23-2 - [0:0] > -A neutron-openvswi-FORWARD -m physdev --physdev-out tapc2c7ef23-2d > --physdev-is-bridged -j neutron-openvswi-sg-chain > -A neutron-openvswi-FORWARD -m physdev --physdev-in tapc2c7ef23-2d > --physdev-is-bridged -j neutron-openvswi-sg-chain > -A neutron-openvswi-INPUT -m physdev --physdev-in tapc2c7ef23-2d > --physdev-is-bridged -j neutron-openvswi-oc2c7ef23-2 > -A neutron-openvswi-ic2c7ef23-2 -m state --state INVALID -j DROP > -A neutron-openvswi-ic2c7ef23-2 -m state --state RELATED,ESTABLISHED -j > RETURN > -A neutron-openvswi-ic2c7ef23-2 -p tcp -m tcp --dport 22 -j RETURN > -A neutron-openvswi-ic2c7ef23-2 -s 10.3.0.2/32 -p udp -m udp --sport 67 > --dport 68 -j RETURN > -A neutron-openvswi-ic2c7ef23-2 -s 10.3.0.4/32 -p udp -m udp --sport 67 > --dport 68 -j RETURN > -A neutron-openvswi-ic2c7ef23-2 -j neutron-openvswi-sg-fallback > -A neutron-openvswi-oc2c7ef23-2 -p udp -m udp --sport 68 --dport 67 -j RETURN > -A neutron-openvswi-oc2c7ef23-2 -j neutron-openvswi-sc2c7ef23-2 > -A neutron-openvswi-oc2c7ef23-2 -p udp -m udp --sport 67 --dport 68 -j DROP > -A neutron-openvswi-oc2c7ef23-2 -m state --state INVALID -j DROP > -A neutron-openvswi-oc2c7ef23-2 -m state --state RELATED,ESTABLISHED -j > RETURN > -A neutron-openvswi-oc2c7ef23-2 -p tcp -m tcp --dport 22 -j RETURN > -A neutron-openvswi-oc2c7ef23-2 -j neutron-openvswi-sg-fallback > -A neutron-openvswi-sc2c7ef23-2 -s 10.3.0.5/32 -m mac --mac-source > FA:16:3E:F5:ED:16 -j RETURN > -A neutron-openvswi-sc2c7ef23-2 -j DROP > -A neutron-openvswi-sg-chain -m physdev --physdev-out tapc2c7ef23-2d > --physdev-is-bridged -j neutron-openvswi-ic2c7ef23-2 > -A neutron-openvswi-sg-chain -m physdev --physdev-in tapc2c7ef23-2d > --physdev-is-bridged -j neutron-openvswi-oc2c7ef23-2 > > and openvswitch config also seems ok: > > 97e21921-f8e5-4156-8f9b-b976bc6ed278 > Bridge br-int > fail_mode: secure > Port int-vm_st_mgmt > Interface int-vm_st_mgmt > .... > Port "qvoc2c7ef23-2d" > tag: 4 > Interface "qvoc2c7ef23-2d" > Port "qvo50e4e17b-ea" > tag: 3 > Interface "qvo50e4e17b-ea" > ... > > and I also see it as linux bridge: > ~☠ brctl show qbrc2c7ef23-2d > bridge name bridge id STP enabled interfaces > qbrc2c7ef23-2d 8000.1a3cb28c1f78 no > qvbc2c7ef23-2d > tapc2c7ef23-2d > > > Yet no packet ever hits IPTables rules. tunneling works fine, I can make any > connection between all machines, DHCP/L3 works, I can see traffic on tap > > Chain neutron-openvswi-INPUT (1 references) > pkts bytes target prot opt in out source > destination > 0 0 neutron-openvswi-o5c1b8fd3-0 all -- * * 0.0.0.0/0 > 0.0.0.0/0 PHYSDEV match --physdev-in tap5c1b8fd3-04 > --physdev-is-bridged > 0 0 neutron-openvswi-oeece6804-f all -- * * 0.0.0.0/0 > 0.0.0.0/0 PHYSDEV match --physdev-in tapeece6804-f4 > --physdev-is-bridged > 0 0 neutron-openvswi-oc2c7ef23-2 all -- * * 0.0.0.0/0 > 0.0.0.0/0 PHYSDEV match --physdev-in tapc2c7ef23-2d > --physdev-is-bridged > 0 0 neutron-openvswi-o50e4e17b-e all -- * * 0.0.0.0/0 > 0.0.0.0/0 PHYSDEV match --physdev-in tap50e4e17b-ea > --physdev-is-bridged > 0 0 neutron-openvswi-o19204ab8-4 all -- * * 0.0.0.0/0 > 0.0.0.0/0 PHYSDEV match --physdev-in tap19204ab8-4d > --physdev-is-bridged > 0 0 neutron-openvswi-o187624fb-e all -- * * 0.0.0.0/0 > 0.0.0.0/0 PHYSDEV match --physdev-in tap187624fb-e4 > --physdev-is-bridged > > Chain INPUT (policy ACCEPT 86M packets, 79G bytes) > pkts bytes target prot opt in out source > destination > 86M 79G neutron-openvswi-INPUT all -- * * 0.0.0.0/0 > 0.0.0.0/0 > > My configuration: > > kernel 3.15.7-1.el6.elrepo.x86_64 > > ☠ rpm -qa |grep -P '(nova|neutron)' > openstack-neutron-2014.1.2-1.el6.noarch > openstack-nova-compute-2014.1.1-3.el6.noarch > python-nova-2014.1.1-3.el6.noarch > python-novaclient-2.17.0-2.el6.noarch > python-neutronclient-2.3.4-1.el6.noarch > openstack-nova-common-2014.1.1-3.el6.noarch > python-neutron-2014.1.2-1.el6.noarch > openstack-neutron-openvswitch-2014.1.2-1.el6.noarch > > nova.conf: > > vif_driver=nova.virt.libvirt.vif.LibvirtGenericVIFDriver # tried with legacy > OVS one, didnt help > linuxnet_interface_driver = nova.network.linux_net.LinuxOVSInterfaceDriver > firewall_driver=nova.virt.firewall.NoopFirewallDriver > > ovs_neutron_plugin: > > [securitygroup] > > > firewall_driver = > neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver > enable_security_group = True > > > [OVS] > enable_tunneling=False > integration_bridge=br-int > local_ip=172.16.125.25 > tunnel_bridge=br-tun > tunnel_type=vxlan > tenant_network_type=vxlan > tunnel_id_ranges=8192:16384 > bridge_mappings=vm_st_mgmt:vm_st_mgmt > > [AGENT] > polling_interval=2 > tunnel_types=vxlan > > neutron plugin.ini: > [ml2] > tenant_network_types = vxlan > mechanism_drivers =openvswitch,linuxbridge > > [ml2_type_vxlan] > > > vni_ranges =8192:16384 > > [securitygroup] > # Controls if neutron security group is enabled or not. > > > # It should be false when you use nova security group. > > > # enable_security_group = True > > > enable_security_group = True > firewall_driver=neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver > > > I attached dumps from iptables/ovs/brctl > -- Mariusz Gronczewski, Administrator Efigence S. A. ul. Wołoska 9a, 02-583 Warszawa T: [+48] 22 380 13 13 F: [+48] 22 380 13 14 E: mariusz.gronczew...@efigence.com <mailto:mariusz.gronczew...@efigence.com>
signature.asc
Description: PGP signature
_______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack@lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
