cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CLOUDSTACK-8843) Guest VMs are not getting IPs as the DHCP port is not opened in VR
Date Wed, 16 Sep 2015 10:02:45 GMT

    [ https://issues.apache.org/jira/browse/CLOUDSTACK-8843?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14747245#comment-14747245
] 

ASF GitHub Bot commented on CLOUDSTACK-8843:
--------------------------------------------

GitHub user jayapalu opened a pull request:

    https://github.com/apache/cloudstack/pull/842

    CLOUDSTACK-8843: Fixed issue in default iptables rules on shared network VR

    On basic zone share network VR default iptables rules are not applied correctly. Due to
this ssh to VR got failed.
    In shared network the VR type is 'dhcpsrvr' not router. So corrected it in the ''del_standard'
method to select the correct type.
    
    Testing:
    1. VR is deployed correctly.
    2. Tested restart, stop, start VR.
    3. New VM deployment is success.
    4. ssh to VR from the host is successful.
    5. iptables rules on the VR came up correctly.
    below is the output from the VR:
    iptables -L INPUT -nv
    Chain INPUT (policy DROP 16 packets, 1056 bytes)
     pkts bytes target     prot opt in     out     source               destination
        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            224.0.0.18
        0     0 ACCEPT     all  --  *      *       0.0.0.0/0            225.0.0.50
      104  9800 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0        
   state RELATED,ESTABLISHED
      281 36500 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0        
   state RELATED,ESTABLISHED
        0     0 ACCEPT     all  --  eth2   *       0.0.0.0/0            0.0.0.0/0        
   state RELATED,ESTABLISHED
        6   504 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
        0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
        2   656 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0        
   udp dpt:67
       13   780 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0        
   tcp dpt:3922 state NEW,ESTABLISHED
        0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0        
   tcp dpt:80 state NEW
        0     0 ACCEPT     tcp  --  eth0   *       10.147.40.0/23       0.0.0.0/0        
   state NEW tcp dpt:8080

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/jayapalu/cloudstack shareNwVR

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/cloudstack/pull/842.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #842
    
----
commit a15df0569fa0e56b14a9a119858c53e8ae6085c3
Author: Jayapal <jayapal@apache.org>
Date:   2015-09-16T09:52:33Z

    CLOUDSTACK-8843: Fixed issue in default iptables rules on shared network VR

----


> Guest VMs are not getting IPs as the DHCP port is not opened in VR
> ------------------------------------------------------------------
>
>                 Key: CLOUDSTACK-8843
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-8843
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Network Controller
>    Affects Versions: 4.6.0
>            Reporter: manasaveloori
>            Assignee: Jayapal Reddy
>            Priority: Blocker
>             Fix For: 4.6.0
>
>
> 1. Deployed CS with latest build.
> 2. Deployed a guest VM.
> 3. VM is not assigned any ip address.
> Observation:
> In VR 67 port is not opened
> root@r-9-VM:~# iptables-save
> # Generated by iptables-save v1.4.14 on Mon Sep 14 09:02:39 2015
> *filter
> :INPUT DROP [10:3400]
> :FORWARD DROP [0:0]
> :OUTPUT ACCEPT [117:15233]
> :FW_OUTBOUND - [0:0]
> :NETWORK_STATS - [0:0]
> -A INPUT -j NETWORK_STATS
> -A INPUT -d 224.0.0.18/32 -j ACCEPT
> -A INPUT -d 225.0.0.50/32 -j ACCEPT
> -A INPUT -i eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -i eth1 -p tcp -m tcp --dport 3922 -m state --state NEW,ESTABLISHED -j ACCEPT
> -A FORWARD -j NETWORK_STATS
> -A OUTPUT -j NETWORK_STATS
> -A FW_OUTBOUND -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A NETWORK_STATS -i eth0 -o eth2
> -A NETWORK_STATS -i eth2 -o eth0
> -A NETWORK_STATS ! -i eth0 -o eth2 -p tcp
> -A NETWORK_STATS -i eth2 ! -o eth0 -p tcp
> COMMIT
> # Completed on Mon Sep 14 09:02:39 2015
> # Generated by iptables-save v1.4.14 on Mon Sep 14 09:02:39 2015
> *nat
> :PREROUTING ACCEPT [83:8482]
> :INPUT ACCEPT [25:1716]
> :OUTPUT ACCEPT [5:380]
> :POSTROUTING ACCEPT [0:0]
> -A POSTROUTING -o eth2 -j SNAT --to-source 10.147.47.7
> COMMIT
> # Completed on Mon Sep 14 09:02:39 2015
> # Generated by iptables-save v1.4.14 on Mon Sep 14 09:02:39 2015
> *mangle
> :PREROUTING ACCEPT [391:44422]
> :INPUT ACCEPT [367:42880]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [342:47621]
> :POSTROUTING ACCEPT [342:47621]
> :FIREWALL_10.147.47.7 - [0:0]
> :VPN_10.147.47.7 - [0:0]
> -A PREROUTING -d 10.147.47.7/32 -j FIREWALL_10.147.47.7
> -A PREROUTING -d 10.147.47.7/32 -j VPN_10.147.47.7
> -A PREROUTING -m state --state RELATED,ESTABLISHED -j CONNMARK --restore-mark --nfmask
0xffffffff --ctmask 0xffffffff
> -A PREROUTING -i eth2 -m state --state NEW -j CONNMARK --set-xmark 0x2/0xffffffff
> -A POSTROUTING -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
> -A FIREWALL_10.147.47.7 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FIREWALL_10.147.47.7 -j DROP
> -A VPN_10.147.47.7 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A VPN_10.147.47.7 -j RETURN
> COMMIT
> # Completed on Mon Sep 14 09:02:39 2015
> root@r-9-VM:~#



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message