Ask Your Question
3

Neutron qrouters not passing traffic onto Virtual Machines

asked 2015-07-16 02:32:54 -0500

nightkhaos gravatar image

updated 2015-07-19 22:23:36 -0500

Hi there,

I am setting a relatively small OpenStack (Juno) deployment which I am trying to deploy to with the aim of moving the current deployment in a production state when I have ironed out all the bugs. (Possibly involving a redeploy with the assistance of Puppet, not sure yet).

However I have encountered a blocker I am unable to overcome. Any QRouters I create do not appear to pass traffic onto the virtual machines. I can ping either side of the router, but any traffic that should be DNATed isn't appearing on the qr side of the router.

Some background on the setup:

  • 3x CentOS 7 Controller/Network Nodes running Neutron OpenVSwitch Agents, Neutron L3 Agents, Neutron DHCP Agents and Metadata Agents (control1 through control3)
  • 7x CentOS 7 Compute Nodes running Neutron OpenVSwitch Agents (compute1 through compute7)

Routers are set to be non-distributed and HA. (I wanted to go distributed and HA unfortunately that isn't yet supported in Juno). We have one external VLAN (47 in this setup) which is our DMZ 10.47.0.0/20, and we have configured this with the goal of adding more VLANs with external allocations in future.

We also have the following networks for various functions:

10.47.16.0/24 Management (VLAN 48) 10.47.17.0/24 Mesh (For GRE Traffic, VLAN 49)

Here is some relevant output and configuration files:

ovs-vsctl show on management node with active router

[root@control3 ~]# ovs-vsctl show
7efc1761-efab-4caa-9932-654caf074936
    Bridge br-tun
        Port "gre-0a01e441"
            Interface "gre-0a01e441"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.65"}
        Port "gre-0a01e451"
            Interface "gre-0a01e451"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.81"}
        Port "gre-0a01e453"
            Interface "gre-0a01e453"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.83"}
        Port "gre-0a01e452"
            Interface "gre-0a01e452"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.82"}
        Port br-tun
            Interface br-tun
                type: internal
        Port "gre-0a01e456"
            Interface "gre-0a01e456"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.86"}
        Port patch-int
            Interface patch-int
                type: patch
                options: {peer=patch-tun}
        Port "gre-0a01e454"
            Interface "gre-0a01e454"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.84"}
        Port "gre-0a01e457"
            Interface "gre-0a01e457"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.87"}
        Port "gre-0a01e440"
            Interface "gre-0a01e440"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.64"}
        Port "gre-0a01e455"
            Interface "gre-0a01e455"
                type: gre
                options: {df_default="true", in_key=flow, local_ip="10.47.17.66", out_key=flow, remote_ip="10.47.17.85"}
    Bridge br-int
        fail_mode: secure
        Port "qr-8668140a-07"
            tag: 1
            Interface "qr-8668140a-07"
                type: internal
        Port patch-tun
            Interface patch-tun
                type: patch
                options: {peer=patch-int}
        Port "tap9e08a279-67"
            tag: 1
            Interface "tap9e08a279-67"
        Port br-int
            Interface ...
(more)
edit retag flag offensive close merge delete

Comments

yeah, it seems the DNAT rule is not being hit. Use iptables-save -c as you ping to see which if any rules are actually being hit. Also try tcpdumping without filtering for icmp only - you could be missing something.

darragh-oreilly gravatar imagedarragh-oreilly ( 2015-07-21 03:19:49 -0500 )edit

After taking your suggestion I noticed that the DNAT is being hit. It is incrementing with each packet. However, the problem is despite the DNAT being hit the packets aren't leaving via the qr interface.

nightkhaos gravatar imagenightkhaos ( 2015-07-21 03:44:17 -0500 )edit

can you ping 10.47.0.132 or 10.47.0.130 from the vm?

darragh-oreilly gravatar imagedarragh-oreilly ( 2015-07-21 08:06:06 -0500 )edit

Yes, I can ping the floating IP address and the external IP address of the router from the vm.

nightkhaos gravatar imagenightkhaos ( 2015-07-21 16:31:58 -0500 )edit

from the vm?

darragh-oreilly gravatar imagedarragh-oreilly ( 2015-07-22 12:16:08 -0500 )edit

1 answer

Sort by ยป oldest newest most voted
0

answered 2015-08-19 18:25:38 -0500

nightkhaos gravatar image

Unfortunately I was unable to track down the specific cause of this issue. All I know for sure is that after we upgraded to Kilo it started working.

I apologise if anyone else is having this issue and requires assistance, I was unable to determine exactly what the problem was.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

2 followers

Stats

Asked: 2015-07-16 02:32:54 -0500

Seen: 450 times

Last updated: Aug 19 '15