Ask Your Question

Can not ping outside world when using NAT-VM / VPN

asked 2016-11-22 16:12:32 -0600

Kevin gravatar image

updated 2016-11-22 17:46:18 -0600


I am running several VMs directly attached to a VLAN in OpenStack Mitaka on CentOS 7. This VM has a public IP address and a private interface. It masquerades on eth0 (public) and gets packages from a client-VM. There also is an OpenVPN connection for external client to reach the client network.

I already set up such scenarios and they are working fine but now I have a compute-node which blocks all traffic when source address does not match (= forwarding). Packets (ICMP) leave the client-vm, arrive at the router-vm, get masqueraded, sent to the external server, I get the reply and forward it back to the client. I can see the packet leaving the router-vm (tcpdump) but not arriving at the client-vm. This effictively cuts the internet access for all client vm's.

As far as I can see, all nodes have the same nova configuration. I use arp-anti-spoof security provided by neutron but the scenario above was working in the past on other nodes (including a Windows VM running on the same node).

The default security group also lists and ::/0 for all protocols ingress and egress.

I am not sure what I need to change or fix for this to work.

edit retag flag offensive close merge delete

2 answers

Sort by ยป oldest newest most voted

answered 2016-11-27 08:54:51 -0600

Kevin gravatar image

Any ideas?

edit flag offensive delete link more

answered 2017-02-01 04:19:06 -0600

Thomas Li gravatar image

2 additional approvals from me, but i cant help you, you should use sdn in the manner it should be use and dont look for intranparent workarounds, but vRouters do not support vpn so you need to forget about routers and establish a tunnel for each vm, when you got a better solution let me know

edit flag offensive delete link more

Get to know Ask OpenStack

Resources for moderators

Question Tools



Asked: 2016-11-22 16:12:32 -0600

Seen: 303 times

Last updated: Feb 01 '17