[openstack-dev] [Openstack] [Neutron] Security groups issue when running latest libvirt?
simon.pasquier at bull.net
Wed Nov 6 17:03:31 UTC 2013
Answering myself as I investigated a little further and cross-posting to
openstack-dev because I'd like to get feedback from Nova/Neutron devs.
Users running Havana should configure
This driver is still available in the Havana release although
deprecated. AFAIU, this is the only option if you want effective
security groups with KVM & OVS.
For people using the master branch of nova, sorry but security groups
are currently broken because LibvirtHybridOVSBridgeDriver is gone ().
Joe Gordon asked the Neutron devs about it few weeks ago  but no
answer and in another review , the conclusion was that the Tempest
tests passed with Neutron. However I don't see anywhere in the tests
(, ) that we check if the security rules allow/block traffic.
It would be nice if core devs could confirm or refute.
Le 05/11/2013 14:57, Simon Pasquier a écrit :
> Hi all,
> I'm struggling with security groups on Havana with Neutron and OVS
> plugin (GRE tunnels). No problem to create/delete security group rules
> but even though iptables configuration is updated, traffic to my
> instances is never filtered .
> I'm running DevStack on 2 nodes (1 controller + 1 compute):
> - OS: Ubuntu 12.04.3 (LTS) with the Havana cloud archive repository.
> - Open vSwitch package version: 1.10.2-0ubuntu2~cloud0
> - libvirt package version: 1.1.1-0ubuntu8~cloud2
> - localrc, nova.conf, neutron.conf and ovs_neutron_plugin.ini files
> pasted at  (I didn't modify any of these files after the DevStack run)
> According to ,  and , iptables is not compatible with TAP
> devices connectd directly to Open vSwitch ports, this is why there used
> to be the additional veth + bridge interfaces . But in my setup, this
> is not the case anymore as shown in  ('ovs-vsctl show' +
> 'iptables-save' ouptut). I've also pasted the libvirt XML configuration
>  that shows that the instance is directly connected to the Open vSwitch.
> Are the security groups supposed to work when the instance is directly
> connected to OVS? If yes, what am I doing wrong?
>  http://paste.openstack.org/show/50490/
>  http://paste.openstack.org/show/50448/
>  http://www.spinics.net/linux/fedora/libvirt-users/msg05384.html
>  http://openvswitch.org/pipermail/discuss/2013-October/011461.html
>  http://paste.openstack.org/show/50486/
>  http://paste.openstack.org/show/50487/
Bull, Architect of an Open World
Phone: + 33 4 76 29 71 49
More information about the OpenStack-dev