Hi Are you running on CentOS7 ?
I am running on CentOS7 , ACS 4.14 , and seem there is no log at of security_group.log # ls /var/log/cloudstack/agent/ agent.log resizevolume.log setup.log I recheck back the Intall guide, seems no missing anything. Older intallation guide, 4.11 mentioned need , allow /usr/lib/sysctl.d/00-system.conf # Enable netfilter on bridges. net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-arptables = 1 And it has been done too. On Mon, Sep 28, 2020 at 4:05 PM Ivan Kudryavtsev <i...@bw-sw.com> wrote: > Hi, > > No, this is not the issue. > It's a normal state of the system, as KVM hooks are a new and optional > feature of 4.14. > > You should find some sort of messages regarding security_groups at > /var/log/cloudstack/agent/security_group.log > > > On Mon, Sep 28, 2020 at 2:10 PM Hean Seng <heans...@gmail.com> wrote: > > > I not sure where goes wrong, are you running on CentOS 7 ? I have this > > error too, do you think is this contribute to the error as well: > > > > 2020-09-28 03:04:52,762 WARN [kvm.resource.LibvirtKvmAgentHook] > > (agentRequest-Handler-5:null) (logid:4f23845b) Groovy script > > '/etc/cloudstack/agent/hooks/libvirt-vm-xml-transformer.groovy' is not > > available. Transformations will not be applied. > > > > 2020-09-28 03:04:52,762 WARN [kvm.resource.LibvirtKvmAgentHook] > > (agentRequest-Handler-5:null) (logid:4f23845b) Groovy scripting engine is > > not initialized. Data transformation skipped. > > > > 2020-09-28 03:04:53,083 WARN [kvm.resource.LibvirtKvmAgentHook] > > (agentRequest-Handler-5:null) (logid:4f23845b) Groovy script > > '/etc/cloudstack/agent/hooks/libvirt-vm-state-change.groovy' is not > > available. Transformations will not be applied. > > > > On Mon, Sep 28, 2020 at 2:27 PM Ivan Kudryavtsev <i...@bw-sw.com> wrote: > > > > > This just means you installed it in the wrong way. Ebtables and > Iptables > > > must be filled with rules like > > > > > > -A i-6242-10304-def -m state --state RELATED,ESTABLISHED -j ACCEPT > > > -A i-6242-10304-def -p udp -m physdev --physdev-in vnet18 > > > --physdev-is-bridged -m udp --sport 68 --dport 67 -j ACCEPT > > > -A i-6242-10304-def -p udp -m physdev --physdev-out vnet18 > > > --physdev-is-bridged -m udp --sport 67 --dport 68 -j ACCEPT > > > -A i-6242-10304-def -m physdev --physdev-in vnet18 --physdev-is-bridged > > -m > > > set ! --match-set i-6242-10304-vm src -j DROP > > > -A i-6242-10304-def -p udp -m physdev --physdev-in vnet18 > > > --physdev-is-bridged -m set --match-set i-6242-10304-vm src -m udp > > --dport > > > 53 -j RETURN > > > -A i-6242-10304-def -p tcp -m physdev --physdev-in vnet18 > > > --physdev-is-bridged -m set --match-set i-6242-10304-vm src -m tcp > > --dport > > > 53 -j RETURN > > > -A i-6242-10304-def -m physdev --physdev-in vnet18 --physdev-is-bridged > > -m > > > set --match-set i-6242-10304-vm src -j i-6242-10304-vm-eg > > > -A i-6242-10304-def -m physdev --physdev-out vnet18 > --physdev-is-bridged > > -j > > > i-6242-10304-vm > > > -A i-6242-10304-vm -p udp -m udp --dport 1:65535 -m state --state NEW > -j > > > ACCEPT > > > -A i-6242-10304-vm -p tcp -m tcp --dport 1:65535 -m state --state NEW > -j > > > ACCEPT > > > -A i-6242-10304-vm -p icmp -m icmp --icmp-type any -j ACCEPT > > > -A i-6242-10304-vm -j DROP > > > > > > > > > Bridge chain: i-4435-8929-vm-in, entries: 7, policy: ACCEPT > > > -s ! 1e:0:32:0:2:2 -j DROP > > > -p ARP -s ! 1e:0:32:0:2:2 -j DROP > > > -p ARP --arp-mac-src ! 1e:0:32:0:2:2 -j DROP > > > -p ARP -j i-4435-8929-vm-in-ips > > > -p ARP --arp-op Request -j ACCEPT > > > -p ARP --arp-op Reply -j ACCEPT > > > -p ARP -j DROP > > > > > > > > > > > > On Mon, Sep 28, 2020 at 1:10 PM Hean Seng <heans...@gmail.com> wrote: > > > > > > > I checked the hypervisor , it seems iptables is nothing inside , > this > > is > > > > centos7 , initially i turnoff firewalld , but even i turn on it now > > and > > > > try to update the security group rules, it seems empty iptable rules > : > > > > > > > > [root@kvm03 ~]# iptables -L -v -n > > > > > > > > Chain INPUT (policy ACCEPT 82903 packets, 1170M bytes) > > > > > > > > pkts bytes target prot opt in out source > > > > destination > > > > > > > > > > > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > > > > > > > > pkts bytes target prot opt in out source > > > > destination > > > > > > > > > > > > Chain OUTPUT (policy ACCEPT 80505 packets, 25M bytes) > > > > > > > > pkts bytes target prot opt in out source > > > > destination > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Mon, Sep 28, 2020 at 12:05 PM Pearl d'Silva < > > > pearl.dsi...@shapeblue.com > > > > > > > > > wrote: > > > > > > > > > Hi Hean, > > > > > > > > > > In an Advanced Zone with Security Groups enabled, by default, > egress > > > > > traffic from the VM is allowed, while Ingress traffic is denied. > > Hence, > > > > as > > > > > you rightly mentioned, security group rules are added accordingly. > > > These > > > > > rules get added on the hypervisor host, and you can verify them, by > > > going > > > > > into the host and searching for iptables rules corresponding to the > > VM > > > > > (internal name - i-x-y-VM). > > > > > This blog maybe helpful in providing further details: > > > > > > > > > > > > > > > > > > > > https://shankerbalan.net/blog/cloudstack-advanced-zone-with-security-groups/ > > > > > > > > > > Thanks, > > > > > Pearl > > > > > ________________________________ > > > > > From: Hean Seng <heans...@gmail.com> > > > > > Sent: Sunday, September 27, 2020 2:48 PM > > > > > To: users@cloudstack.apache.org <users@cloudstack.apache.org> > > > > > Subject: Cloudstack Advance with Security Group > > > > > > > > > > Hi > > > > > > > > > > I created advance zone with security group, all working fine. > > > > > > > > > > But VMcreated ， seems the default security group that assigned to > the > > > VM. > > > > > all accept policy , i understand is Default Deny, and once add in > > the > > > > port > > > > > in Security Group Ingress and Egress, only is allowed > > > > > > > > > > Also, is this rules created at VirtualRouter of the SharedNetwork, > or > > > at > > > > > the Hypervisor? > > > > > > > > > > > > > > > > > > > > -- > > > > > Regards, > > > > > Hean Seng > > > > > > > > > > pearl.dsi...@shapeblue.com > > > > > www.shapeblue.com > > > > > 3 London Bridge Street, 3rd floor, News Building, London SE1 > 9SGUK > > > > > @shapeblue > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > Regards, > > > > Hean Seng > > > > > > > > > > > > > -- > > Regards, > > Hean Seng > > > -- Regards, Hean Seng
