Hi, No, this is not the issue. It's a normal state of the system, as KVM hooks are a new and optional feature of 4.14.
You should find some sort of messages regarding security_groups at /var/log/cloudstack/agent/security_group.log On Mon, Sep 28, 2020 at 2:10 PM Hean Seng <heans...@gmail.com> wrote: > I not sure where goes wrong, are you running on CentOS 7 ? I have this > error too, do you think is this contribute to the error as well: > > 2020-09-28 03:04:52,762 WARN [kvm.resource.LibvirtKvmAgentHook] > (agentRequest-Handler-5:null) (logid:4f23845b) Groovy script > '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.groovy' is not > available. Transformations will not be applied. > > 2020-09-28 03:04:52,762 WARN [kvm.resource.LibvirtKvmAgentHook] > (agentRequest-Handler-5:null) (logid:4f23845b) Groovy scripting engine is > not initialized. Data transformation skipped. > > 2020-09-28 03:04:53,083 WARN [kvm.resource.LibvirtKvmAgentHook] > (agentRequest-Handler-5:null) (logid:4f23845b) Groovy script > '/etc/cloudstack/agent/hooks/libvirt-vm-state-change.groovy' is not > available. Transformations will not be applied. > > On Mon, Sep 28, 2020 at 2:27 PM Ivan Kudryavtsev <i...@bw-sw.com> wrote: > > > This just means you installed it in the wrong way. Ebtables and Iptables > > must be filled with rules like > > > > -A i-6242-10304-def -m state --state RELATED,ESTABLISHED -j ACCEPT > > -A i-6242-10304-def -p udp -m physdev --physdev-in vnet18 > > --physdev-is-bridged -m udp --sport 68 --dport 67 -j ACCEPT > > -A i-6242-10304-def -p udp -m physdev --physdev-out vnet18 > > --physdev-is-bridged -m udp --sport 67 --dport 68 -j ACCEPT > > -A i-6242-10304-def -m physdev --physdev-in vnet18 --physdev-is-bridged > -m > > set ! --match-set i-6242-10304-vm src -j DROP > > -A i-6242-10304-def -p udp -m physdev --physdev-in vnet18 > > --physdev-is-bridged -m set --match-set i-6242-10304-vm src -m udp > --dport > > 53 -j RETURN > > -A i-6242-10304-def -p tcp -m physdev --physdev-in vnet18 > > --physdev-is-bridged -m set --match-set i-6242-10304-vm src -m tcp > --dport > > 53 -j RETURN > > -A i-6242-10304-def -m physdev --physdev-in vnet18 --physdev-is-bridged > -m > > set --match-set i-6242-10304-vm src -j i-6242-10304-vm-eg > > -A i-6242-10304-def -m physdev --physdev-out vnet18 --physdev-is-bridged > -j > > i-6242-10304-vm > > -A i-6242-10304-vm -p udp -m udp --dport 1:65535 -m state --state NEW -j > > ACCEPT > > -A i-6242-10304-vm -p tcp -m tcp --dport 1:65535 -m state --state NEW -j > > ACCEPT > > -A i-6242-10304-vm -p icmp -m icmp --icmp-type any -j ACCEPT > > -A i-6242-10304-vm -j DROP > > > > > > Bridge chain: i-4435-8929-vm-in, entries: 7, policy: ACCEPT > > -s ! 1e:0:32:0:2:2 -j DROP > > -p ARP -s ! 1e:0:32:0:2:2 -j DROP > > -p ARP --arp-mac-src ! 1e:0:32:0:2:2 -j DROP > > -p ARP -j i-4435-8929-vm-in-ips > > -p ARP --arp-op Request -j ACCEPT > > -p ARP --arp-op Reply -j ACCEPT > > -p ARP -j DROP > > > > > > > > On Mon, Sep 28, 2020 at 1:10 PM Hean Seng <heans...@gmail.com> wrote: > > > > > I checked the hypervisor , it seems iptables is nothing inside , this > is > > > centos7 , initially i turnoff firewalld , but even i turn on it now > and > > > try to update the security group rules, it seems empty iptable rules : > > > > > > [root@kvm03 ~]# iptables -L -v -n > > > > > > Chain INPUT (policy ACCEPT 82903 packets, 1170M bytes) > > > > > > pkts bytes target prot opt in out source > > > destination > > > > > > > > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > > > > > > pkts bytes target prot opt in out source > > > destination > > > > > > > > > Chain OUTPUT (policy ACCEPT 80505 packets, 25M bytes) > > > > > > pkts bytes target prot opt in out source > > > destination > > > > > > > > > > > > > > > > > > > > > > > > On Mon, Sep 28, 2020 at 12:05 PM Pearl d'Silva < > > pearl.dsi...@shapeblue.com > > > > > > > wrote: > > > > > > > Hi Hean, > > > > > > > > In an Advanced Zone with Security Groups enabled, by default, egress > > > > traffic from the VM is allowed, while Ingress traffic is denied. > Hence, > > > as > > > > you rightly mentioned, security group rules are added accordingly. > > These > > > > rules get added on the hypervisor host, and you can verify them, by > > going > > > > into the host and searching for iptables rules corresponding to the > VM > > > > (internal name - i-x-y-VM). > > > > This blog maybe helpful in providing further details: > > > > > > > > > > > > > > https://shankerbalan.net/blog/cloudstack-advanced-zone-with-security-groups/ > > > > > > > > Thanks, > > > > Pearl > > > > ________________________________ > > > > From: Hean Seng <heans...@gmail.com> > > > > Sent: Sunday, September 27, 2020 2:48 PM > > > > To: users@cloudstack.apache.org <users@cloudstack.apache.org> > > > > Subject: Cloudstack Advance with Security Group > > > > > > > > Hi > > > > > > > > I created advance zone with security group, all working fine. > > > > > > > > But VMcreated ， seems the default security group that assigned to the > > VM. > > > > all accept policy , i understand is Default Deny, and once add in > the > > > port > > > > in Security Group Ingress and Egress, only is allowed > > > > > > > > Also, is this rules created at VirtualRouter of the SharedNetwork, or > > at > > > > the Hypervisor? > > > > > > > > > > > > > > > > -- > > > > Regards, > > > > Hean Seng > > > > > > > > pearl.dsi...@shapeblue.com > > > > www.shapeblue.com > > > > 3 London Bridge Street, 3rd floor, News Building, London SE1 9SGUK > > > > @shapeblue > > > > > > > > > > > > > > > > > > > > > > -- > > > Regards, > > > Hean Seng > > > > > > > > -- > Regards, > Hean Seng >
