<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi nova-devs,<div class=""><br class=""></div><div class="">I raised a bug about nova-api-metadata messing with iptables on a host </div><div class=""><br class=""></div><div class=""><a href="https://bugs.launchpad.net/nova/+bug/1648643" class="">https://bugs.launchpad.net/nova/+bug/1648643</a></div><div class=""><br class=""></div><div class="">It got closed as won’t fix but I think it could do with a little more discussion.</div><div class=""><br class=""></div><div class="">Currently nova-api-metadata will create an iptable rule and also delete other rules on the host. This was needed for back in the nova-network days as there was some trickery going on there.</div><div class="">Now with neutron and neutron-metadata-proxy nova-api-metadata is little more that a web server much like nova-api.</div><div class=""><br class=""></div><div class="">I may be missing some use case but I don’t think nova-api-metadata needs to care about firewall rules (much like nova-api doesn’t care about firewall rules)</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Sam</div><div class=""><br class=""></div></body></html>