I have an OpenStack Folsom, with Quantum networking, installation that I'm
having trouble getting additional rules into the iptables on nova-compute
nodes. The online manual
(http://docs.openstack.org/trunk/openstack-ops/content/iptables.html) states
that "You must use OpenStack to manage iptables." What it doesn't include is
any indication of how that is done. How can iptables be managed with OpenStack?
When I add rules to the file /etc/sysconfig/iptables, sometimes the
nova-compute service fails to work properly. A new instance on the node may not
get an IP address or the vnc service in Horizon does not respond. The instance
is listed in the database with an assigned IP, but the address is not reachable.
Does the iptables service need to be "off" in the context of chkconfig? That
is, don't let it start through the rc sequence, but let nova-compute start it
and populate the rules?
If iptables is started in the rc sequence, then are there some rules that
should not be in /etc/sysconfig/iptables?
If the rc sequence is not used, how do ports unrelated to OpenStack services
get enabled?
Does the default response for a packet sent to non-OpenStack related port drop
the packet or let it pass?
Thanks,
Craig
--
Craig E. Ward
Information Sciences Institute
University of Southern California
cw...@isi.edu
_______________________________________________
Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to : openstack@lists.openstack.org
Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
