Hi All, We have seen this in 2 separate environments, both running the same versions of Cloudstack and Xenserver. When we reboot an instance, we lose access to it.
Looking at the iptables config on the xen host, we can see that the vif is incremented for the bridged entries, but not updated for the rules. For example, this is how the iptables look before a reboot: [root@xen001 cloud]# iptables -L|grep 25075 i-2-25075-def all -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged i-2-25075-def all -- anywhere anywhere PHYSDEV match --physdev-out vif108.0 --physdev-is-bridged Chain i-2-25075-VM (1 references) Chain i-2-25075-VM-eg (1 references) Chain i-2-25075-def (2 references) RETURN udp -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged match-set i-2-25075-VM src udp dpt:domain DROP all -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged ! match-set i-2-25075-VM src DROP all -- anywhere anywhere PHYSDEV match --physdev-out vif108.0 --physdev-is-bridged ! match-set i-2-25075-VM dst i-2-25075-VM-eg all -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged match-set i-2-25075-VM src i-2-25075-VM all -- anywhere anywhere PHYSDEV match --physdev-out vif108.0 --physdev-is-bridged After a reboot, we can see the following: [root@xen001 cloud]# iptables -L|grep 25075 i-2-25075-def all -- anywhere anywhere PHYSDEV match --physdev-in vif109.0 --physdev-is-bridged i-2-25075-def all -- anywhere anywhere PHYSDEV match --physdev-out vif109.0 --physdev-is-bridged Chain i-2-25075-VM (1 references) Chain i-2-25075-VM-eg (1 references) Chain i-2-25075-def (2 references) RETURN udp -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged match-set i-2-25075-VM src udp dpt:domain DROP all -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged ! match-set i-2-25075-VM src DROP all -- anywhere anywhere PHYSDEV match --physdev-out vif108.0 --physdev-is-bridged ! match-set i-2-25075-VM dst i-2-25075-VM-eg all -- anywhere anywhere PHYSDEV match --physdev-in vif108.0 --physdev-is-bridged match-set i-2-25075-VM src i-2-25075-VM all -- anywhere anywhere PHYSDEV match --physdev-out vif108.0 --physdev-is-bridged You can see that the bridged entries have been incremented to vif109, where as the rules still reference vif108. Stopping the instance appears to clear out the rules, and then everything works fine again once the instance is started. Is this a known issue? Is anyone able to replicate this? Cheers!
