I not sure where goes wrong, are you running on CentOS 7 ? I have this error too, do you think is this contribute to the error as well:
2020-09-28 03:04:52,762 WARN [kvm.resource.LibvirtKvmAgentHook] (agentRequest-Handler-5:null) (logid:4f23845b) Groovy script '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.groovy' is not available. Transformations will not be applied. 2020-09-28 03:04:52,762 WARN [kvm.resource.LibvirtKvmAgentHook] (agentRequest-Handler-5:null) (logid:4f23845b) Groovy scripting engine is not initialized. Data transformation skipped. 2020-09-28 03:04:53,083 WARN [kvm.resource.LibvirtKvmAgentHook] (agentRequest-Handler-5:null) (logid:4f23845b) Groovy script '/etc/cloudstack/agent/hooks/libvirt-vm-state-change.groovy' is not available. Transformations will not be applied. On Mon, Sep 28, 2020 at 2:27 PM Ivan Kudryavtsev <i...@bw-sw.com> wrote: > This just means you installed it in the wrong way. Ebtables and Iptables > must be filled with rules like > > -A i-6242-10304-def -m state --state RELATED,ESTABLISHED -j ACCEPT > -A i-6242-10304-def -p udp -m physdev --physdev-in vnet18 > --physdev-is-bridged -m udp --sport 68 --dport 67 -j ACCEPT > -A i-6242-10304-def -p udp -m physdev --physdev-out vnet18 > --physdev-is-bridged -m udp --sport 67 --dport 68 -j ACCEPT > -A i-6242-10304-def -m physdev --physdev-in vnet18 --physdev-is-bridged -m > set ! --match-set i-6242-10304-vm src -j DROP > -A i-6242-10304-def -p udp -m physdev --physdev-in vnet18 > --physdev-is-bridged -m set --match-set i-6242-10304-vm src -m udp --dport > 53 -j RETURN > -A i-6242-10304-def -p tcp -m physdev --physdev-in vnet18 > --physdev-is-bridged -m set --match-set i-6242-10304-vm src -m tcp --dport > 53 -j RETURN > -A i-6242-10304-def -m physdev --physdev-in vnet18 --physdev-is-bridged -m > set --match-set i-6242-10304-vm src -j i-6242-10304-vm-eg > -A i-6242-10304-def -m physdev --physdev-out vnet18 --physdev-is-bridged -j > i-6242-10304-vm > -A i-6242-10304-vm -p udp -m udp --dport 1:65535 -m state --state NEW -j > ACCEPT > -A i-6242-10304-vm -p tcp -m tcp --dport 1:65535 -m state --state NEW -j > ACCEPT > -A i-6242-10304-vm -p icmp -m icmp --icmp-type any -j ACCEPT > -A i-6242-10304-vm -j DROP > > > Bridge chain: i-4435-8929-vm-in, entries: 7, policy: ACCEPT > -s ! 1e:0:32:0:2:2 -j DROP > -p ARP -s ! 1e:0:32:0:2:2 -j DROP > -p ARP --arp-mac-src ! 1e:0:32:0:2:2 -j DROP > -p ARP -j i-4435-8929-vm-in-ips > -p ARP --arp-op Request -j ACCEPT > -p ARP --arp-op Reply -j ACCEPT > -p ARP -j DROP > > > > On Mon, Sep 28, 2020 at 1:10 PM Hean Seng <heans...@gmail.com> wrote: > > > I checked the hypervisor , it seems iptables is nothing inside , this is > > centos7 , initially i turnoff firewalld , but even i turn on it now and > > try to update the security group rules, it seems empty iptable rules : > > > > [root@kvm03 ~]# iptables -L -v -n > > > > Chain INPUT (policy ACCEPT 82903 packets, 1170M bytes) > > > > pkts bytes target prot opt in out source > > destination > > > > > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > > > > pkts bytes target prot opt in out source > > destination > > > > > > Chain OUTPUT (policy ACCEPT 80505 packets, 25M bytes) > > > > pkts bytes target prot opt in out source > > destination > > > > > > > > > > > > > > > > On Mon, Sep 28, 2020 at 12:05 PM Pearl d'Silva < > pearl.dsi...@shapeblue.com > > > > > wrote: > > > > > Hi Hean, > > > > > > In an Advanced Zone with Security Groups enabled, by default, egress > > > traffic from the VM is allowed, while Ingress traffic is denied. Hence, > > as > > > you rightly mentioned, security group rules are added accordingly. > These > > > rules get added on the hypervisor host, and you can verify them, by > going > > > into the host and searching for iptables rules corresponding to the VM > > > (internal name - i-x-y-VM). > > > This blog maybe helpful in providing further details: > > > > > > > > > https://shankerbalan.net/blog/cloudstack-advanced-zone-with-security-groups/ > > > > > > Thanks, > > > Pearl > > > ________________________________ > > > From: Hean Seng <heans...@gmail.com> > > > Sent: Sunday, September 27, 2020 2:48 PM > > > To: users@cloudstack.apache.org <users@cloudstack.apache.org> > > > Subject: Cloudstack Advance with Security Group > > > > > > Hi > > > > > > I created advance zone with security group, all working fine. > > > > > > But VMcreated ， seems the default security group that assigned to the > VM. > > > all accept policy , i understand is Default Deny, and once add in the > > port > > > in Security Group Ingress and Egress, only is allowed > > > > > > Also, is this rules created at VirtualRouter of the SharedNetwork, or > at > > > the Hypervisor? > > > > > > > > > > > > -- > > > Regards, > > > Hean Seng > > > > > > pearl.dsi...@shapeblue.com > > > www.shapeblue.com > > > 3 London Bridge Street, 3rd floor, News Building, London SE1 9SGUK > > > @shapeblue > > > > > > > > > > > > > > > > -- > > Regards, > > Hean Seng > > > -- Regards, Hean Seng
