Mailing-List: contact users-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@cloudstack.apache.org
MIME-Version: 1.0
References: 
 <CAJOo_nc-n+Y+1d=24rSPUdBG_M-jYkVs4v+N5+AVAt3QJCfj3w@mail.gmail.com>
 <DB5PR07MB115960B081FFDF2294338ED78C9D0@DB5PR07MB1159.eurprd07.prod.outlook.com>
 <CAG97raezOPKaO54=R9Gk2FTG4on1n90qzn+5tBbiRf05yiufZg@mail.gmail.com>
 <CAJOo_nd2PKGYSKczkzxtDbOK+H9ovX4TNKwb5biCaeRo+C5UjA@mail.gmail.com>
 <CAG97raf=yLpVKQGHhFaCP10hAsAW7csEwzrsqOLARdJ3JQA6NQ@mail.gmail.com>
In-Reply-To: 
 <CAG97raf=yLpVKQGHhFaCP10hAsAW7csEwzrsqOLARdJ3JQA6NQ@mail.gmail.com>
From: Syafiq Rokman <msyafiq.rokman@gmail.com>
Date: Tue, 05 Apr 2016 12:36:51 +0000
Message-ID: 
 <CAJOo_neBrvKDpGhvDLr2chsU72Q9Y=52wPxvsmyf0Ef53FvWtA@mail.gmail.com>
Subject: Re: SSVM cant route to MS, Iptables keep self-updating
To: "users@cloudstack.apache.org" <users@cloudstack.apache.org>
Content-Type: multipart/alternative; boundary=089e0103e3660e5972052fbc1a93

--089e0103e3660e5972052fbc1a93
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I've checked the host iptables just now...there were rules accomodating the
SSVM and CPVM.
But I've made the mistake of flushing the iptables rules without any backup=
.
 Now Iptables -P, -L has:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -j ACCEPT
-A INPUT -j ACCEPT
-A FORWARD -j ACCEPT
-A OUTPUT -j ACCEPT
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

One more thing, this setup is self-hosted.The MS and host are on the same
machine.


On Tue, Apr 5, 2016 at 8:22 PM Rafael Weing=C3=A4rtner <
rafaelweingartner@gmail.com> wrote:

> Those rules should not block the "ping" comand, hence they are meant to
> block "http" right?
>
>
> I have been having the same problem lately with XenServer.
>
> The iptables rules that are rejecting my traffic are at the host itself.
>
> Can you check your host iptables configs?
>
> On Tue, Apr 5, 2016 at 3:42 AM, Syafiq Rokman <msyafiq.rokman@gmail.com>
> wrote:
>
> > Hi,
> >
> > Can't ping the default gateway of the SSVM or 8.8.8.8 from the SSVM.
> > I'm using KVM as hypervisor.
> >
> > Tried changing iptables rules on SSVM using
> >
> > iptables -F
> > iptables -X
> > iptables -t nat -F
> > iptables -t nat -X
> > iptables -t mangle -F
> > iptables -t mangle -X
> > iptables -P INPUT ACCEPT
> > iptables -P FORWARD ACCEPT
> > iptables -P OUTPUT ACCEPT
> >
> > to allow all connections, but keep getting this at Chain OUTPUT:
> >
> > REJECT     tcp  --  anywhere             anywhere             state NEW
> tcp
> > dpt:http reject-with icmp-port-unreachable
> > REJECT     tcp  --  anywhere             anywhere             state NEW
> tcp
> > dpt:https reject-with icmp-port-unreachable
> >
> >
> >
> > On Mon, Apr 4, 2016 at 6:49 PM Rafael Weing=C3=A4rtner <
> > rafaelweingartner@gmail.com> wrote:
> >
> > > What hypervisor are you using?
> > > Did change the iptables rules at the SSVM itself?
> > >
> > > On Mon, Apr 4, 2016 at 6:50 AM, Glenn Wagner <
> glenn.wagner@shapeblue.com
> > >
> > > wrote:
> > >
> > > > Hi,
> > > >
> > > > Can you ping the default gateway of the SSVM?
> > > > Can you ping google DNS 8.8.8.8 from the SSVM?
> > > >
> > > > Thanks
> > > > Glenn
> > > >
> > > >
> > > > Regards,
> > > >
> > > > Glenn Wagner
> > > >
> > > > glenn.wagner@shapeblue.com
> > > > www.shapeblue.com
> > > > 2nd Floor, Oudehuis Centre, 122 Main Rd, Somerset West, Cape Town
> > > > 7130South Africa
> > > > @shapeblue
> > > >
> > > > -----Original Message-----
> > > > From: Syafiq Rokman [mailto:msyafiq.rokman@gmail.com]
> > > > Sent: Monday, 04 April 2016 11:16 AM
> > > > To: users@cloudstack.apache.org
> > > > Subject: SSVM cant route to MS, Iptables keep self-updating
> > > >
> > > > Hi everyone!
> > > >
> > > > Im running CS 4.8 on Ubuntu 14.04 LTS.
> > > >
> > > > So I've managed to set up everything, but I still cant install
> > templates.
> > > > So I SSH-ed into the SSVM and ran the healthcheck and it seems that
> the
> > > > SSVM can't connect to the DNS.
> > > >
> > > > Logs says that it can't route to host.
> > > >
> > > > So I've tried to allow all outgoing/incoming connections on Iptable=
s,
> > but
> > > > it keeps changing back to deny outgoing connections.
> > > >
> > > > Any ideas on how to proceed?
> > > >
> > > > Will provide logs if anyone needs it.
> > > >
> > > > Thanks
> > > > Syafiq Rokman
> > > > B.ICT Student
> > > >
> > >
> > >
> > >
> > > --
> > > Rafael Weing=C3=A4rtner
> > >
> >
>
>
>
> --
> Rafael Weing=C3=A4rtner
>
--=20
Syafiq Rokman
B. ICT Student
Universiti Teknologi PETRONAS

--089e0103e3660e5972052fbc1a93--