Re: [Users] SPICE behind NAT

2014-02-14 Thread Michal Skrivanek
On Feb 14, 2014, at 01:38 , Andrew Lau and...@andrewklau.com wrote: You just need some proper DST and SRC Nat rules and you should be fine. I use mikrotik so its slightly different but the same concept applies. For windows, I don't know, never really cared much as no one uses windows on

Re: [Users] SPICE behind NAT

2014-02-13 Thread Alan Murrell
Quoting Andrew Lau and...@andrewklau.com: Your value for SpiceDefaultProxy should be your external IP address/hostname otherwise external users will never know where to connect to. So the spice proxy would be going out the firewall then looping back in (also known as hairpinning), which in

Re: [Users] SPICE behind NAT

2014-02-13 Thread Andrew Lau
You just need some proper DST and SRC Nat rules and you should be fine. I use mikrotik so its slightly different but the same concept applies. For windows, I don't know, never really cared much as no one uses windows on our ovirt setup :) But the client tools you linked are for the client

Re: [Users] SPICE behind NAT

2014-02-11 Thread Alan Murrell
Looks like I am talking to myself now, but I will post my latest findings, as I have had some time today to poke at this a bit. It seems that the issues I last posted about may be specific to whn using the Windows Remote-Viewer client, as that is what I was testing with yesterday (and when

Re: [Users] SPICE behind NAT

2014-02-11 Thread Andrew Lau
Your value for SpiceDefaultProxy should be your external IP address/hostname otherwise external users will never know where to connect to. This then becomes more of a firewall issue as you're spice proxy is working. But just to confirm, if you open up console through chrome it should download a

Re: [Users] SPICE behind NAT

2014-02-10 Thread Alan Murrell
Just got a chance to get back to this. Looks like I cannot connect using SPICE at all, even from the internal network. I could connect fine (from internal network) before the attempted proxy changes :-( When I try to connect using SPICE, the black console windows pops ups, and just says

Re: [Users] SPICE behind NAT

2014-02-07 Thread Alan Murrell
Hi Andrew, Thanks for the reply. Quoting Andrew Lau and...@andrewklau.com: Just install squid proxy and port forward the 3128 port through your firewall you should be all good. Is squid installed on your oVirt box or is it on your firewall? Or did ypu srtup a seperate box ad the proxy?

Re: [Users] SPICE behind NAT

2014-02-07 Thread Andrew Lau
On Sat, Feb 8, 2014 at 9:11 AM, Alan Murrell li...@murrell.ca wrote: Hi Andrew, Thanks for the reply. Quoting Andrew Lau and...@andrewklau.com: Just install squid proxy and port forward the 3128 port through your firewall you should be all good. Is squid installed on your oVirt box

Re: [Users] SPICE behind NAT

2014-02-07 Thread Alan Murrell
I followed your notes, installing Squid on my oVirt server (I have an all-in-one installation). I set a port forward on our firewall for port 3128 to my oVirt server. I logged into the User Portal and tried connecting to the console, but I get Could not connect to graphic server (null). Not

Re: [Users] SPICE behind NAT

2014-02-07 Thread Andrew Lau
Lots of variables here: - Can you connect to squid from your browser? - Did you modify the squid.conf to match your setup? (dst addresses, etc). - iptables? - restarted engine? - If you're using ovirt 3.4 make sure you set the cluster policy too On Sat, Feb 8, 2014 at 3:15 PM, Alan Murrell