I have successfully got XenServer 6.2 up and running with VMs on
VLAN/FLAT networks (Icehouse). DHCP is working too. Looking at the
IPtables rules generated on Dom0 I would think security groups should be
working, but no matter what I do, even deleting all rules, the VMs are
100% wide open -- and can even even use other IPs not assigned to them.
I have doubt over the 'tap' bridge references (e.g. tap6be30d08-87) in
iptables. There are no corresponding bridges with 'tap' names in
ifconfig or ovs-vsctl.
I found these 'warnings' on the compute node:
Command: ['neutron-rootwrap-xen-dom0', '/etc/neutron/rootwrap.conf',
'iptables-restore', '-c']
Exit code: 0
Stdout: "Warning: wierd character in interface `tap6be30d08-87' (No
aliases, :, ! or *).\nWarning: wierd character in interface
`tap6be30d08-87' (No aliases, :, ! or *).\nWarning: wierd character in
interface `tap6be30d08-87' (No aliases, :, ! or *).\nWarning: wierd
character in interface `tap6be30d08-87' (No aliases, :, ! or
*).\nWarning: wierd character in interface `tap6be30d08-87' (No aliases,
:, ! or *).\n\n"
And here is the iptables on Dom0:
Chain neutron-filter-top (2 references)
target prot opt source destination
neutron-openvswi-local all -- anywhere anywhere
Chain neutron-openvswi-FORWARD (1 references)
target prot opt source destination
neutron-openvswi-sg-chain all -- anywhere anywhere
PHYSDEV match --physdev-out tap6be30d08-87 --physdev-is-bridged
neutron-openvswi-sg-chain all -- anywhere anywhere
PHYSDEV match --physdev-in tap6be30d08-87 --physdev-is-bridged
Chain neutron-openvswi-INPUT (1 references)
target prot opt source destination
neutron-openvswi-o6be30d08-8 all -- anywhere anywhere
PHYSDEV match --physdev-in tap6be30d08-87 --physdev-is-bridged
Chain neutron-openvswi-OUTPUT (1 references)
target prot opt source destination
Chain neutron-openvswi-i6be30d08-8 (1 references)
target prot opt source destination
DROP all -- anywhere anywhere state
INVALID
RETURN all -- anywhere anywhere state
RELATED,ESTABLISHED
RETURN tcp -- anywhere anywhere tcp
dpt:mysql
RETURN tcp -- anywhere anywhere tcp
dpt:pop3
RETURN udp -- 198.98.181.228 anywhere udp
spt:bootps dpt:bootpc
neutron-openvswi-sg-fallback all -- anywhere anywhere
Chain neutron-openvswi-local (1 references)
target prot opt source destination
Chain neutron-openvswi-o6be30d08-8 (2 references)
target prot opt source destination
RETURN udp -- anywhere anywhere udp
spt:bootpc dpt:bootps
neutron-openvswi-s6be30d08-8 all -- anywhere anywhere
DROP udp -- anywhere anywhere udp
spt:bootps dpt:bootpc
DROP all -- anywhere anywhere state
INVALID
RETURN all -- anywhere anywhere state
RELATED,ESTABLISHED
neutron-openvswi-sg-fallback all -- anywhere anywhere
Chain neutron-openvswi-s6be30d08-8 (1 references)
target prot opt source destination
RETURN all -- 198.98.181.230 anywhere MAC
FA:16:3E:5F:CA:31
DROP all -- anywhere anywhere
Chain neutron-openvswi-sg-chain (2 references)
target prot opt source destination
neutron-openvswi-i6be30d08-8 all -- anywhere anywhere
PHYSDEV match --physdev-out tap6be30d08-87 --physdev-is-bridged
neutron-openvswi-o6be30d08-8 all -- anywhere anywhere
PHYSDEV match --physdev-in tap6be30d08-87 --physdev-is-bridged
ACCEPT all -- anywhere anywhere
Chain neutron-openvswi-sg-fallback (2 references)
target prot opt source destination
DROP all -- anywhere anywhere
--
~Randy
_______________________________________________
Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to : [email protected]
Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
