<div>Hi Leandro, </div><div><br></div><div>I will try to summarize where we are, may be there something that can help you.</div><div><br></div><div>All the issues we are finding comes because we split the network traffic in different networks on different NICs. So the nova-network node has three NICs:</div>
<div><br></div><div>eth0 ---> Public Network Traffic (109.x.y.z)</div><div>eth1 ---> Management Network Traffic (10.x.y.z)</div><div>eth2 ---> Service Network (no IP configured)</div><div><br></div><div>The first problem we found was that by default eth0 becomes the 'my_ip' value at boot time if you don't specify it manually in the nova configuration file (nova-network.conf in Stackops distro). So you need to explicitly write the Management IP (eth1) value of nova-network in 'my_ip'. Otherwise the iptables rules won't work. </div>
<div><br></div><div>But this is not the only problem. Now you have communication from the virtual machines to the metadata server (actually the nova-api), but we always get a HTTP 500 error. Hugo's rule does not work, probably there is something we are missing. </div>
<div><br></div><div>Here goes the iptables-save of my nova-network node:</div><div><br></div><div><div><font class="Apple-style-span" face="'courier new', monospace"># Generated by iptables-save v1.4.4 on Tue May 31 12:05:57 2011</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">*nat</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:PREROUTING ACCEPT [17:1836]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:POSTROUTING ACCEPT [219:13140]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:OUTPUT ACCEPT [378:67677]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-OUTPUT - [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-POSTROUTING - [0:0]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-PREROUTING - [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-floating-snat - [0:0]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-snat - [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:nova-postrouting-bottom - [0:0]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A PREROUTING -j nova-network-PREROUTING </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A POSTROUTING -j nova-network-POSTROUTING </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A POSTROUTING -j nova-postrouting-bottom </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A OUTPUT -j nova-network-OUTPUT </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-POSTROUTING -s <a href="http://10.0.0.0/16">10.0.0.0/16</a> -d <a href="http://10.128.0.0/24">10.128.0.0/24</a> -j ACCEPT </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-POSTROUTING -s <a href="http://10.0.0.0/16">10.0.0.0/16</a> -d <a href="http://10.0.0.0/16">10.0.0.0/16</a> -j ACCEPT </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-PREROUTING -d <a href="http://169.254.169.254/32">169.254.169.254/32</a> -p tcp -m tcp --dport 80 -j DNAT --to-destination <a href="http://10.15.10.129:8773">10.15.10.129:8773</a> </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-snat -j nova-network-floating-snat </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-snat -s <a href="http://10.0.0.0/16">10.0.0.0/16</a> -j SNAT --to-source 10.15.10.130 </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A nova-postrouting-bottom -j nova-network-snat </font></div><div><font class="Apple-style-span" face="'courier new', monospace">COMMIT</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace"># Completed on Tue May 31 12:05:57 2011</font></div><div><font class="Apple-style-span" face="'courier new', monospace"># Generated by iptables-save v1.4.4 on Tue May 31 12:05:57 2011</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">*filter</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:INPUT ACCEPT [44496:6777975]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:FORWARD ACCEPT [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:OUTPUT ACCEPT [79531:8634032]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:nova-filter-top - [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-FORWARD - [0:0]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-INPUT - [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-OUTPUT - [0:0]</font></div><div><font class="Apple-style-span" face="'courier new', monospace">:nova-network-local - [0:0]</font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A INPUT -j nova-network-INPUT </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A FORWARD -j nova-filter-top </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A FORWARD -j nova-network-FORWARD </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A OUTPUT -j nova-filter-top </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A OUTPUT -j nova-network-OUTPUT </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A nova-filter-top -j nova-network-local </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-FORWARD -i br100 -j ACCEPT </font></div><div><font class="Apple-style-span" face="'courier new', monospace">-A nova-network-FORWARD -o br100 -j ACCEPT </font></div>
<div><font class="Apple-style-span" face="'courier new', monospace">COMMIT</font></div><div><font class="Apple-style-span" face="'courier new', monospace"># Completed on Tue May 31 12:05:57 2011</font></div>
</div><div><br></div><div>of course, any help will be welcomed ;-)</div><div><br></div><div>The nova-controller where the nova-api runs has two NICs:</div><div><br></div><div><meta charset="utf-8"><div>eth0 ---> Public Network Traffic (109.x.y.z)</div>
<div>eth1 ---> Management Network Traffic (10.x.y.z)</div></div><div><br></div><div>I changed the my_ip to eth1 IP value. The default gateway in this network is in the Public network. No gateway for Management Network.</div>
<div><br></div><div>Regards</div><div>Diego</div><div><br></div><br><div class="gmail_quote">2011/5/30 Leandro Reox <span dir="ltr"><<a href="mailto:leandro.reox@gmail.com">leandro.reox@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Sadly we already read that blog, and didnt work either :( <br><br>I really cant believe that all the people that has an already running environment didnt deal with this , or maybe they bundeled they own image and theyre not using cloud-init<div>
<br></div><div>Regards<br>Lele<div><div></div><div class="h5"><br><br><div class="gmail_quote">2011/5/30 Diego Parrilla Santamaría <span dir="ltr"><<a href="mailto:diego.parrilla.santamaria@gmail.com" target="_blank">diego.parrilla.santamaria@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Leandro,<div><br></div><div>We have an open issue in our distro regarding this topic. There is a workaround in this blog <a href="http://hugokuo-hugo.blogspot.com/2011/05/prerouting-169254169254-should-not-be.html" target="_blank">http://hugokuo-hugo.blogspot.com/2011/05/prerouting-169254169254-should-not-be.html</a></div>
<div><br></div><div>Sadly, it did not work for us, or we did something wrong... </div><div><br></div><div>Let us know if it works for you,</div><div><br></div><div>Regards</div><div>Diego</div><div><br clear="all"><div>-- <br>
<span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"><div align="left">
<div><font size="2"><span style="font-family:Arial" lang="ES">Diego Parrilla<br><a href="http://www.stackops.com" title="file:///C:/Documents%20and%20Settings/carolina.capsir.per1/Application%20Data/Microsoft/Signatures/www.garrigues.com
www.garrigues.com" style="color:rgb(7, 77, 143)" target="_blank"><span title="file:///C:/Documents%20and%20Settings/carolina.capsir.per1/Application%20Data/Microsoft/Signatures/www.garrigues.com"></span></a></span></font><font style="font-family:arial,helvetica,sans-serif" face="Arial" size="2"><b>CEO</b><font size="1"><br>
</font></font><span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"></span></span><b><font style="font-family:arial,helvetica,sans-serif" face="Arial" size="2"><a href="http://www.stackops.com/" target="_blank"><b>www.stackops.com</b></a> | </font></b><font style="font-family:arial,helvetica,sans-serif" face="Arial" size="2"><font size="1"> <a href="mailto:diego.parrilla@stackops.com" target="_blank">diego.parrilla@stackops.com</a></font></font><span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"><font color="#004438" face="Arial" size="2"><b><b><span style="font-size:10pt;color:rgb(0, 68, 56);font-family:Arial" lang="EN-GB"></span></b></b></font></span></span><font style="font-family:arial,helvetica,sans-serif" face="Arial" size="2"><font size="1"> | </font></font><span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"><font style="font-family:arial,helvetica,sans-serif" face="Arial" size="2"><font size="1"><a href="tel:%2B34%20649%2094%2043%2029" value="+34649944329" target="_blank">+34 649 94 43 29</a> | <a>skype:diegoparrilla</a></font></font></span></span><font style="font-family:arial,helvetica,sans-serif" face="Arial" size="2"><a href="http://www.stackops.com" target="_blank"><b><br>
</b></a></font></div></div><div><font color="#004438" face="Arial" size="2"><b><p><span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"><span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"><font color="#004438" face="Arial" size="2"><b><b><span style="font-size:10pt;color:rgb(0, 68, 56);font-family:Arial" lang="EN-GB"><img src="http://stackops.s3-external-3.amazonaws.com/STACKOPSLOGO-ICON.png"></span></b></b></font></span></span></span></span></p>
</b></font></div><div><p><font color="#000000" size="1">******************** ADVERTENCIA LEGAL ********************<span> </span><br>Le
informamos, como destinatario de este mensaje, que el correo
electrónico y las comunicaciones por medio de Internet no permiten
asegurar ni garantizar la confidencialidad de los mensajes transmitidos,
así como tampoco su integridad o su correcta recepción, por lo que
STACKOPS TECHNOLOGIES S.L. no asume responsabilidad alguna por tales
circunstancias. Si no consintiese en la utilización del correo
electrónico o de las comunicaciones vía Internet le rogamos nos lo
comunique y ponga en nuestro conocimiento de manera inmediata. Este
mensaje va dirigido, de manera exclusiva, a su destinatario y contiene
información confidencial y sujeta al secreto profesional, cuya
divulgación no está permitida por la ley. En caso de haber recibido este
mensaje por error, le rogamos que, de forma inmediata, nos lo comunique
mediante correo electrónico remitido a nuestra atención y proceda a su
eliminación, así como a la de cualquier documento adjunto al mismo.
Asimismo, le comunicamos que la distribución, copia o utilización de
este mensaje, o de cualquier documento adjunto al mismo, cualquiera que
fuera su finalidad, están prohibidas por la ley.<span> </span><br><br>***************** PRIVILEGED AND CONFIDENTIAL ****************<span> </span><br>We
hereby inform you, as addressee of this message, that e-mail and
Internet do not guarantee the confidentiality, nor the completeness or
proper reception of the messages sent and, thus, STACKOPS TECHNOLOGIES
S.L. does not assume any liability for those circumstances. Should you
not agree to the use of e-mail or to communications via Internet, you
are kindly requested to notify us immediately. This message is intended
exclusively for the person to whom it is addressed and contains
privileged and confidential information protected from disclosure by
law. If you are not the addressee indicated in this message, you should
immediately delete it and any attachments and notify the sender by reply
e-mail. In such case, you are hereby notified that any dissemination,
distribution, copying or use of this message or any attachments, for any
purpose, is strictly prohibited by law.</font></p></div></span></span><br></div><br>
<br><br><div class="gmail_quote"><div><div></div><div>On Fri, May 27, 2011 at 10:01 PM, Leandro Reox <span dir="ltr"><<a href="mailto:leandro.reox@gmail.com" target="_blank">leandro.reox@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div></div><div>
Hi all, <br><br>In a multinode environment has anyone succeed booting up images ( ubuntu - cloud init ) that request the metadata to the ip 169.254.269.254 ?<div><br></div><div>NOTE: instances booting on the controller node (that has also compute services running, boots up ok ... no luck getting instances running on the ADDITIONAL compute node :( )<br>
<br>- Already tried<div>-- iptables rule on the controller/network node</div><div>-- ip addres on the loopback controller/network node</div><div>-- ip address on the br100 controller/network node</div>
<div>-- static route on the aditional compute node</div><div>-- iptables rule on the aditional compute node</div><div>-- ip address on the loopback on the aditional compute node</div><div>-- ip address on the br100 on the aditional compute node</div>
<div><br></div><div>Still the same ugly message ! </div><div><br></div><div>tcpdumping all over the network , the request is sent back from the network node repliing with the 169.254.269.254 but doesnt getting into the VM ?</div>
<div><br></div><div>Any clues of how to get this working ???? <br><br><br>Best Regards<br><br>lele</div></div>
<br></div></div>_______________________________________________<br>
Openstack-operators mailing list<br>
<a href="mailto:Openstack-operators@lists.openstack.org" target="_blank">Openstack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br>