VM instance can't reach external network. NATed packet not return.
Hello,
I have setup of 3 servers:
- Controller
- Compute
- Storage
# neutron net-list
extnet01 10.61.4.192/26
private01 192.168.101.0/24
VM IP: 192.168.101.17
DHCP IP: 192.168.101.13
Neutron router internal IP: 192.168.101.1
Neutron router external IP: 10.61.4.194
Physical gateway: 10.61.4.193
# ip netns
qrouter-dbd8ca7a-4ab1-40b5-accb-9e1d4ac7d2d0
qdhcp-eb7fbd59-27df-4d36-ae5e-3cc2e48c3511
# QROUTER namespace
# ip netns exec qrouter-dbd8ca7a-4ab1-40b5-accb-9e1d4ac7d2d0 ip a
74: qr-edc0f100-bd: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:0a:cd:d0 brd ff:ff:ff:ff:ff:ff
inet 192.168.101.1/24 brd 192.168.101.255 scope global qr-edc0f100-bd
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fe0a:cdd0/64 scope link
valid_lft forever preferred_lft forever
75: qg-b04f2489-1f: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:a7:29:d4 brd ff:ff:ff:ff:ff:ff
inet 10.61.4.194/26 brd 10.61.4.255 scope global qg-b04f2489-1f
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fea7:29d4/64 scope link
valid_lft forever preferred_lft forever
# CONTROLER OVS-VSCTL
# ovs-vsctl show
qr- and qg- are in the br-int bridge, and tagged with different vlan tags.
74cea2c7-67dc-421b-9e63-3a415b1b04a1
Bridge br-int
fail_mode: secure
Port "qr-edc0f100-bd"
tag: 1
Interface "qr-edc0f100-bd"
type: internal
Port "qg-b04f2489-1f"
tag: 2
Interface "qg-b04f2489-1f"
type: internal
Port patch-tun
Interface patch-tun
type: patch
options: {peer=patch-int}
Port int-br-ex
Interface int-br-ex
Port br-int
Interface br-int
type: internal
Port "tap1a0b65dc-f4"
tag: 1
Interface "tap1a0b65dc-f4"
type: internal
Bridge br-ex
Port br-ex
Interface br-ex
type: internal
Port phy-br-ex
Interface phy-br-ex
Port "enp21s0f0.43"
Interface "enp21s0f0.43"
Bridge br-tun
Port patch-int
Interface patch-int
type: patch
options: {peer=patch-tun}
Port "vxlan-c0a86402"
Interface "vxlan-c0a86402"
type: vxlan
options: {in_key=flow, local_ip="192.168.100.1", out_key=flow, remote_ip="192.168.100.2"}
Port br-tun
Interface br-tun
type: internal
ovs_version: "2.1.3"
# BR-TUN FLOWS (Controller)
1(patch-int): addr:56:be:61:85:00:a7
2(vxlan-0a000003): addr:b6:03:f5:96:36:e6
3(vxlan-c0a86402): addr:c2:c2:2a:4d:78:e7
4(vxlan-c0a86404): addr:4a:93:cc:5a:5a:14
LOCAL(br-tun): addr:fa:73:27:33:4c:48
NXST_FLOW reply (xid=0x4):
cookie=0x0, duration=3446.279s, table=0, n_packets=0, n_bytes=0, idle_age=3446, priority=0 actions=drop
cookie=0x0, duration=3445.508s, table=0, n_packets=552, n_bytes=41156, idle_age=1008, priority=1,in_port=3 actions=resubmit(,3)
cookie=0x0, duration=3446.327s, table=0, n_packets=625, n_bytes=71926, idle_age=172, priority=1,in_port=1 actions=resubmit(,1)
cookie=0x0, duration=3445.360s, table=0, n_packets=388, n_bytes=41553, idle_age=172, priority=1,in_port=4 actions=resubmit(,3)
cookie=0x0, duration=3445.658s, table=0, n_packets=0, n_bytes=0, idle_age=3445, priority=1,in_port=2 actions=resubmit(,3)
cookie=0x0, duration=3446.181s, table=1, n_packets=45, n_bytes=3880, idle_age=901, priority=1,dl_dst=01:00:00:00:00:00/01:00:00:00:00:00 actions=resubmit(,21)
cookie=0x0, duration=3446.230s, table=1, n_packets ...
What says :
For your particular tenant ( say boris)
[root@icehouse1 ~(keystone_boris)]# nova secgroup-list-rules default
[root@icehouse1 ~(keystone_admin)]# ip netns exec qrouter-router-id iptables -S -t nat | grep 169.254
What says :
[root@icehouse1 ~(keystone_admin)]# ip netns exec qrouter-router-id netstat -antp
[root@icehouse1 ~(keystone_admin)]# neutron router-list
[root@icehouse1 ~(keystone_admin)]# ip netns exec qrouter-router-id iptables -S -t nat
How to fix issues with metadata_agent and metadata_proxy ? I have same problem with you- can' curl 169.254.169.254
Read all the comments for this question and you will get your problem fixed.
please share me your config about network node