RDO setup. Instances cannot access external network, while external network cannot ping instances
I'm new to OpenStack. I'm using RDO packstack --allinone setup.
All openstack nodes reside in one single machine, with only one physical ethernet interface (eth0, 192.168.0.11)
I launched two instances(Test6 and Test7) and set up public and private network, then assigned floating ips to both of them.
network topology image see here: http://postimg.org/image/yumejw07n/
Public Network is 192.168.0.192/26, Private Network is 10.0.0.0/24.
Test6 network is 10.0.0.15 and 192.168.0.204, Test7 network is 10.0.0.17 and 192.168.0.199
A router connect among test6 test7 and public network, 10.0.0.1 to the private network, 192.168.0.203 to the public network.
In Private network, Test6 , Test7, and Router can ping or access between each other. (any public network address or private network address).
In Public, no hosts in public network can access Test6, Test7 or Router (192.168.0.203), nor instances can access hosts.
I think I missed some iptables configurations for bridge, but I didn't figure it out what filter should I add.
On host:
#ovs-vsctl show
bc3a6627-8bfa-4d4a-b75a-a360b1d9ebe2
Bridge br-int
Port patch-tun
Interface patch-tun
type: patch
options: {peer=patch-int}
Port "qvoa86f386a-84"
tag: 1
Interface "qvoa86f386a-84"
Port "tap816bfb16-c3"
tag: 4095
Interface "tap816bfb16-c3"
Port "qvof5f02caa-df"
tag: 1
Interface "qvof5f02caa-df"
Port "tapa37e0f14-18"
tag: 1
Interface "tapa37e0f14-18"
Port "qr-095473ef-8f"
tag: 1
Interface "qr-095473ef-8f"
type: internal
Port br-int
Interface br-int
type: internal
Port "qr-34feb8f5-dd"
tag: 2
Interface "qr-34feb8f5-dd"
type: internal
Bridge br-ex
Port "eth0"
Interface "eth0"
Port br-ex
Interface br-ex
type: internal
Bridge br-tun
Port patch-int
Interface patch-int
type: patch
options: {peer=patch-tun}
Port br-tun
Interface br-tun
type: internal
ovs_version: "1.11.0"
#iptables -t nat -L -nv
Chain PREROUTING (policy ACCEPT 49201 packets, 7639K bytes)
pkts bytes target prot opt in out source destination
49201 7639K neutron-openvswi-PREROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
42619 6708K nova-api-metadat-PREROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
42619 6708K nova-api-PREROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 15292 packets, 934K bytes)
pkts bytes target prot opt in out source destination
15292 934K neutron-openvswi-POSTROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
15292 934K neutron-postrouting-bottom all -- * * 0.0.0.0/0 0.0.0.0/0
12768 779K nova-api-metadat-POSTROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
12791 781K nova-api-POSTROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
15292 934K nova-postrouting-bottom all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 15266 packets, 932K bytes)
pkts bytes target prot opt in out source destination
15266 932K neutron-openvswi-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
12760 779K nova-api-metadat-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
12783 780K nova-api-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain neutron-openvswi-OUTPUT ...
Have you setup security-group rules :
Yes, I have set that. I can ping and ssh among instances and router namespace(ie, ip netns exec <router-ns> ping)
Could you create test CirrOS 0.3.2 VM
I'm currently working on it, and i'm trying to re-install the packstack, but I failed to install it, so I cannot show you the list. But I can tell you, inside VM, I cannot ping to external network (not even the router set in OpenStack dashboard).
When I finished the installation, I will show you
To reinstall:
$ packstack --answer-file=./answer-file-left-by-previous-run