Hi, now I want to use iptables to control VMs, but it seems Open Vswitch do not work well with iptables.
It seems the feature of "openstack security group" has solved this problem, how do you make it work?
You need to use the LibvirtHybridOVSBridgeDriver VIF driver. Then each VIF gets connected to br-int via its own Linux bridge, and the iptables rules are applied on the Linux bridge devices. The connections will look like:
tap12345678-12 --> qbr12345678-12 --> qvb12345678-12 --(veth)--> qvo12345678-12 --> br-int
So here the VM is connected to tap12345678-12, which is plugged into Linux bridge qbr12345678-12, which is connected to br-int with a veth pair.
To use this driver and Quantum security groups, you need these lines in nova.conf:
security_group_api = quantum
libvirt_vif_driver = nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver
firewall_driver = nova.virt.firewall.NoopFirewallDriver
And these lines in ovs_quantum_plugin.ini:
[SECURITYGROUP]
firewall_driver = quantum.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
Yes, OVS and Linux bridge can work together. What OS+version are you on?
Sorry, I don't know Suse. You might have to built OVS from source, or maybe just the kernel module. Don't use the bridge compatibility module.
Asked: 2013-08-20 00:26:49 -0600
Seen: 3,613 times
Last updated: Aug 20 '13
