incubator-cloudstack-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From 曹伟 <c...@travelsky.com>
Subject Issue about use DefaultSharedNetworkOffering in BasicNetworkZone with KVM
Date Tue, 15 May 2012 13:13:31 GMT
Dear all,

 

I don’t want to use Security Group to isolate VMs so I create a
BasicNetwork Zone with network offering “DefaultSharedNetworkOffering”.

But when I added host to the zone and created VM on it , the KVM host still
startup iptables rules( I think the KVM host use iptables rules to achieve
security group function) and isolate the VM's network traffic, it’s useless
even I stop iptalbes service. 

And because I use DefaultSharedNetworkOffering, so there is no place to
modify the ingress rules.

 

I want to know what is the reason?

 

Below is the iptables status of the KVM host, you can see that it drop all
traffic to i-2-3-VM( the red lines) :

 

Table: mangle

Chain PREROUTING (policy ACCEPT)

num target prot opt source destination 

 

Chain INPUT (policy ACCEPT)

num target prot opt source destination 

 

Chain FORWARD (policy ACCEPT)

num target prot opt source destination 

 

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination 

 

Chain POSTROUTING (policy ACCEPT)

num target prot opt source destination 

1 CHECKSUM udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68 CHECKSUM fill 

 

Table: nat

Chain PREROUTING (policy ACCEPT)

num target prot opt source destination 

 

Chain POSTROUTING (policy ACCEPT)

num target prot opt source destination 

 

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination 

 

Table: filter

Chain INPUT (policy ACCEPT)

num target prot opt source destination 

1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:49152:49216 

2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:5900:6100 

3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:16509 

4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 

 

Chain FORWARD (policy ACCEPT)

num target prot opt source destination 

1 BF-cloudbr0 all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-is-bridged 

2 BF-cloudbr0 all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-is-bridged 

3 DROP all -- 0.0.0.0/0 0.0.0.0/0 

4 DROP all -- 0.0.0.0/0 0.0.0.0/0 

 

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination 

 

Chain BF-cloudbr0 (2 references)

num target prot opt source destination 

1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 

2 BF-cloudbr0-IN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-is-in
--physdev-is-bridged 

3 BF-cloudbr0-OUT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-is-out
--physdev-is-bridged 

4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out p2p2
--physdev-is-bridged 

 

Chain BF-cloudbr0-IN (1 references)

num target prot opt source destination 

1 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0
--physdev-is-bridged 

2 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet1
--physdev-is-bridged 

3 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet2
--physdev-is-bridged 

4 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet3
--physdev-is-bridged 

5 v-2-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet4
--physdev-is-bridged 

6 v-2-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet5
--physdev-is-bridged 

7 v-2-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet6
--physdev-is-bridged 

8 r-4-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet7
--physdev-is-bridged 

9 r-4-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet8
--physdev-is-bridged 

10 i-2-3-def all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet9
--physdev-is-bridged 

 

Chain BF-cloudbr0-OUT (1 references)

num target prot opt source destination 

1 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet0
--physdev-is-bridged 

2 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet1
--physdev-is-bridged 

3 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet2
--physdev-is-bridged 

4 s-1-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet3
--physdev-is-bridged 

5 v-2-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet4
--physdev-is-bridged 

6 v-2-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet5
--physdev-is-bridged 

7 v-2-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet6
--physdev-is-bridged 

8 r-4-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet7
--physdev-is-bridged 

9 r-4-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet8
--physdev-is-bridged 

10 i-2-3-def all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet9
--physdev-is-bridged 

 

Chain i-2-3-VM (1 references)

num target prot opt source destination 

1 DROP all -- 0.0.0.0/0 0.0.0.0/0 

 

Chain i-2-3-VM-eg (1 references)

num target prot opt source destination 

 

Chain i-2-3-def (2 references)

num target prot opt source destination 

1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 

2 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet9
--physdev-is-bridged udp spt:68 dpt:67 

3 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet9
--physdev-is-bridged udp spt:67 dpt:68 

4 RETURN udp -- 10.6.159.202 0.0.0.0/0 PHYSDEV match --physdev-in vnet9
--physdev-is-bridged udp dpt:53 

5 i-2-3-VM-eg all -- 10.6.159.202 0.0.0.0/0 PHYSDEV match --physdev-in vnet9
--physdev-is-bridged 

6 i-2-3-VM all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vnet9
--physdev-is-bridged

 

Chain r-4-VM (4 references)

num target prot opt source destination 

1 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet7
--physdev-is-bridged 

2 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet8
--physdev-is-bridged 

3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 

 

Chain s-1-VM (8 references)

num target prot opt source destination 

1 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0
--physdev-is-bridged 

2 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet1
--physdev-is-bridged 

3 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet2
--physdev-is-bridged 

4 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet3
--physdev-is-bridged 

5 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 

 

Chain v-2-VM (6 references)

num target prot opt source destination 

1 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet4
--physdev-is-bridged 

2 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet5
--physdev-is-bridged 

3 RETURN all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet6
--physdev-is-bridged 

4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

 

 

Regards.

 

 

Cao Wei | Senior Technical Consultant | Travelsky | Cell: +86 10 13552493131
| Address: 157 Dongsi West Street, Dongcheng District, Beijing, China
(100010)

 


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message