hello

first of all you need to add the rules like all-icmp and all-tcp rules to your instance

nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0  (is used for PING)
nova secgroup-add-rule default tcp 22 22 0.0.0.0/0 (is used for SSH)

then try to ping and SSH to your instance.

please do check the documentation of image you trying to build.

try this enable network forwarding

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Can you able to ping external network from instance ? if yes means you have to open firewall in openstack instance.

In project (the admin project) you have to configure your Security Groups under Compute—>Access & Security—>Security Groups. Once there click Manage Rules for the default security group. Delete what’s there. Add Ingress/Egress for ALL ICMP, ALL TCP, and ALL UDP accepting all other defaults on the form. This will open up your firewall completely.

My deployment is based on Rocky.

Incomming traffic (to the instance)

What may help is to research this command:

ip netns

somewhere like here: http://man7.org/linux/man-pages/man8/ip-netns.8.html (man ip)

Finding network namespaces

There may be several network namespaces available in your hypervisor (a host). All of which have their "handlers" in the filesystem:

sudo ls /var/run/netns/

You will also list the namespaces independently from the above by typeing:

ip netns list

Running processes using the namespaces

One of the network namespaces may be a qrouter, like: "qrouter-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", commands run in this namespace may be usefull, like:

 ip netns exec qrouter-xxxxxxxx ping 10.10.10.3

...which simply means: use the "ip" command to execute the "ping" command using the namespace "qrouter-xxxxxxx"

Following the the aforementioned manual page will help you find more applications of "ip netns"; for example, I have managed to ssh into the instance:

sudo ip netns exec qrouter-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ssh cirros@10.10.10.3

Outgoing traffic (from the instances)

This is not yet a full response on this part of the subject, however, loosening the firewall rules helps with some aspects.

Traffic between instances

The instances are guarded by the firewall. Setting six rules: all TCP + all UDP + all ICMP (for both: engress and ingress) will open the instances to talking freely to each other. Credits for this go user: pandiarajan.s - who came up with this above.

(last minute edit: I hope to be back with an update on an outbound traffic from instances to the world)