<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Richard:</div><div><br></div><div>Yes, Linux bridging is required for all security groups to be applied via iptables, and that's exactly why brcompat needs to be disabled. </div><div><br></div><div>When "brcompat" is enabled, when OpenStack Neutron does "brctl addbr" to create a Linux bridge, Linux actually creates an openvswitch bridge instead(!). That's why everything breaks. </div><div><br></div><div>So, to ensure that the "brctl addbr" commands actually create Linux bridges and not openvswitch bridges, brcompat shouldn't be running. This will ensure that Neutron can properly create Linux bridges when it needs to.</div><div><br></div><div>I think brcompat is actually going away altogether, according to this comment on a question I asked on <a href="http://unix.stackexchange.com">unix.stackexchange.com</a> [1]. While brcompat used to be documented in the openvswitch FAQ [2], it's not in the FAQ anymore [3].</div><div><br></div><div>[1]: <a href="http://unix.stackexchange.com/questions/89408/equivalent-of-openvswitch-brcompat-on-fedora-rhel-centos">http://unix.stackexchange.com/questions/89408/equivalent-of-openvswitch-brcompat-on-fedora-rhel-centos</a></div><div>[2]: <a href="http://openvswitch.org/pipermail/dev/2012-June/018214.html">http://openvswitch.org/pipermail/dev/2012-June/018214.html</a></div><div>[3]: <a href="http://git.openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=blob_plain;f=FAQ;hb=HEAD">http://git.openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=blob_plain;f=FAQ;hb=HEAD</a></div><div><br></div><div>Take care,</div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>Lorin</div><div>--</div><div>Lorin Hochstein</div><div>Lead Architect - Cloud Services</div><div>Nimbis Services, Inc.</div><div><a href="https://www.nimbisservices.com/">www.nimbisservices.com</a></div><div><br></div></div></span><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></span><br class="Apple-interchange-newline">
</div>
<br><div><div>On Sep 5, 2013, at 11:46 AM, Richard Boswell <<a href="mailto:richard.boswell@gmail.com">richard.boswell@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">@Lorin, if brcompat is removed how does one use GRE tunnels then? My understanding (or misunderstanding?) from the code is that Linux bridging is required to all for the security groups to be applied via iptables.<br>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Sep 5, 2013 at 8:00 AM, <span dir="ltr"><<a href="mailto:openstack-operators-request@lists.openstack.org" target="_blank">openstack-operators-request@lists.openstack.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send OpenStack-operators mailing list submissions to<br>
<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:openstack-operators-request@lists.openstack.org">openstack-operators-request@lists.openstack.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:openstack-operators-owner@lists.openstack.org">openstack-operators-owner@lists.openstack.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of OpenStack-operators digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Quantum Security Groups not working - iptables rules are<br>
not Evaluated (Lorin Hochstein)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 4 Sep 2013 11:20:46 -0400<br>
From: Lorin Hochstein <<a href="mailto:lorin@nimbisservices.com">lorin@nimbisservices.com</a>><br>
To: Sebastian Porombka <<a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a>><br>
Cc: Holger Nitsche <<a href="mailto:hn@uni-paderborn.de">hn@uni-paderborn.de</a>>,<br>
"<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>"<br>
<<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
Subject: Re: [Openstack-operators] Quantum Security Groups not working<br>
- iptables rules are not Evaluated<br>
Message-ID:<br>
<<a href="mailto:CADzpNMUQT--UcOk1-Q9k-yBj7vMvppz20SHS7xyXR6xOgiAqug@mail.gmail.com">CADzpNMUQT--UcOk1-Q9k-yBj7vMvppz20SHS7xyXR6xOgiAqug@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Darragh updated the docs, there's now a warning here:<br>
<br>
<a href="http://docs.openstack.org/trunk/openstack-network/admin/content/install_neutron_agent_ovs.html" target="_blank">http://docs.openstack.org/trunk/openstack-network/admin/content/install_neutron_agent_ovs.html</a><br>
<br>
<br>
<br>
On Mon, Sep 2, 2013 at 3:12 PM, Sebastian Porombka <<br>
<a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a>> wrote:<br>
<br>
> Hi<br>
><br>
> Yes, openvswitch-brcompat (as ubuntu package) was installed.<br>
> Uninstalling the package removes the qbr* interfaces in<br>
> 'ovs-vsctl show' and solved the problem. Big thanks to you.<br>
><br>
> Maybe a short sentence in the documentation would be nice. :)<br>
><br>
> Greetings<br>
> Sebastian<br>
><br>
> --<br>
> Sebastian Porombka, M.Sc.<br>
> Zentrum f?r Informations- und Medientechnologien (IMT)<br>
> Universit?t Paderborn<br>
><br>
> E-Mail: <a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a><br>
> Tel.: 05251/60-5999<br>
> Fax: 05251/60-48-5999<br>
> Raum: N5.314<br>
><br>
> --------------------------------------------<br>
> Q: Why is this email five sentences or less?<br>
> A: <a href="http://five.sentenc.es/" target="_blank">http://five.sentenc.es</a><br>
><br>
> Please consider the environment before printing this email.<br>
><br>
><br>
><br>
><br>
><br>
> Am 02.09.13 17:28 schrieb "Darragh O'Reilly" unter<br>
> <<a href="mailto:dara2002-openstack@yahoo.com">dara2002-openstack@yahoo.com</a>>:<br>
><br>
> >Hi Lorin,<br>
> ><br>
> >sure, sorry for the beverity. It seems the brcompat is being used because<br>
> >qbr0188455b-25 appears in the 'ovs-vsctl show' output - so it was created<br>
> >as an OVS bridge, but it should have been created as a Linux bridge. I<br>
> >have never used brcompat, but I believe it intercepts calls from brctl<br>
> >and configures OVS bridges instead of Linux bridges. I'm not sure how to<br>
> >uninstall/disable it - it's probably an Operating System package.<br>
> ><br>
> >I don't think any Openstack doc says to install/enable it.<br>
> ><br>
> >Re,<br>
> >Darragh.<br>
> ><br>
> >>________________________________<br>
> >> From: Lorin Hochstein <<a href="mailto:lorin@nimbisservices.com">lorin@nimbisservices.com</a>><br>
> >>To: Darragh O'Reilly <<a href="mailto:dara2002-openstack@yahoo.com">dara2002-openstack@yahoo.com</a>><br>
> >>Cc: Sebastian Porombka <<a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a>>;<br>
> >>"<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>"<br>
> >><<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
> >>Sent: Monday, 2 September 2013, 16:00<br>
> >>Subject: Re: [Openstack-operators] Quantum Security Groups not working -<br>
> >>iptables rules are not Evaluated<br>
> >><br>
> >><br>
> >><br>
> >>Darragh:<br>
> >><br>
> >><br>
> >>Can you elaborate on this a little more? Do you mean that the "brcompat"<br>
> >>kernel module has been loaded, and this breaks security groups with the<br>
> >>ovs plugin? Should we add something in the documentation about this?<br>
> >><br>
> >><br>
> >>Lorin<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >>Do you mean that the problem is that the ovs-brcompatd service is<br>
> >>running?<br>
> >><br>
> >><br>
> >>openvswitch-brcompat package is installed?<br>
> >><br>
> >><br>
> >><br>
> >>On Mon, Sep 2, 2013 at 10:21 AM, Darragh O'Reilly<br>
> >><<a href="mailto:dara2002-openstack@yahoo.com">dara2002-openstack@yahoo.com</a>> wrote:<br>
> >><br>
> >><br>
> >>>it is not working because you are using the ovs bridge compatibility<br>
> >>>module.<br>
> >>><br>
> >>>Re,<br>
> >>>Darragh.<br>
> >>><br>
> >>>>________________________________<br>
> >>>> From: Sebastian Porombka <<a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a>><br>
> >>>>To: "<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>"<br>
> >>>><<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
> >>>>Sent: Monday, 2 September 2013, 14:48<br>
> >>>>Subject: [Openstack-operators] Quantum Security Groups not working -<br>
> >>>>iptables rules are not Evaluated<br>
> >>><br>
> >>>><br>
> >>>><br>
> >>>><br>
> >>>>Hi folks.<br>
> >>>><br>
> >>>><br>
> >>>>We're currently on the way to deploy an openstack (grizzly) cloud<br>
> >>>>environment<br>
> >>>>and suffering in problems implementing the security groups like<br>
> >>>>described in [1].<br>
> >>>><br>
> >>>><br>
> >>>>The (hopefully) relevant configuration settings are:<br>
> >>>><br>
> >>>><br>
> >>>>/etc/nova/nova.conf<br>
> >>>>[?]<br>
> >>>>security_group_api=quantum<br>
> >>>>network_api_class=nova.network.quantumv2.api.API<br>
> >>>>libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver<br>
> >>>>firewall_driver=nova.virt.firewall.NoopFirewallDriver<br>
> >>>>[?]<br>
> >>>><br>
> >>>><br>
> >>>>/etc/quantum/plugins/openvswitch/ovs_quantum_plugin.ini<br>
> >>>>[?]<br>
> >>>>firewall_driver =<br>
> >>>>quantum.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver<br>
> >>>>[?]<br>
> >>>><br>
> >>>><br>
> >>>>The Networks for the vm's are attached to the compute-nodes via VLAN<br>
> >>>>encapsulation and correctly mapped to the vm's.<br>
> >>>><br>
> >>>><br>
> >>>>From our point of view - we're understanding the need of the<br>
> >>>>"ovs-bridge <> veth glue <> linux-bridge (for filtering) <><br>
> >>>>vm"-construction<br>
> >>>>and observed the single components in our deployment. See [2]<br>
> >>>><br>
> >>>><br>
> >>>>Everything is working except the security groups.<br>
> >>>>We observed that ip-tables rules are generated for the<br>
> >>>>quantum-openvswi-* chains of iptables.<br>
> >>>>And the traffic arriving untagged (native vlan for management) on the<br>
> >>>>machine is processed by iptables but not<br>
> >>>>the traffic which arrived encapsulated.<br>
> >>>><br>
> >>>><br>
> >>>>The traffic which is unpacked by openvswitch and is bridged via the<br>
> >>>>veth and the tap into<br>
> >>>>the machine isn't processed by the iptables rules.<br>
> >>>><br>
> >>>><br>
> >>>>We have no remaining clue/idea how to solve this issue? :(<br>
> >>>><br>
> >>>><br>
> >>>>Greetings<br>
> >>>> Sebastian<br>
> >>>><br>
> >>>><br>
> >>>>[1]<br>
> >>>><br>
> <a href="http://docs.openstack.org/trunk/openstack-network/admin/content/under_t" target="_blank">http://docs.openstack.org/trunk/openstack-network/admin/content/under_t</a><br>
> >>>>he_hood_openvswitch.html<br>
> >>>>[2] <a href="http://pastebin.com/WXMH6y4A" target="_blank">http://pastebin.com/WXMH6y4A</a><br>
> >>>><br>
> >>>><br>
> >>>>--<br>
> >>>>Sebastian Porombka, M.Sc.<br>
> >>>>Zentrum f?r Informations- und Medientechnologien (IMT)<br>
> >>>>Universit?t Paderborn<br>
> >>>><br>
> >>>><br>
> >>>>E-Mail: <a href="mailto:porombka@uni-paderborn.de">porombka@uni-paderborn.de</a><br>
> >>>>Tel.: 05251/60-5999<br>
> >>>>Fax: 05251/60-48-5999<br>
> >>>>Raum: N5.314<br>
> >>>><br>
> >>>><br>
> >>>>--------------------------------------------<br>
> >>>>Q: Why is this email five sentences or less?<br>
> >>>>A: <a href="http://five.sentenc.es/" target="_blank">http://five.sentenc.es</a><br>
> >>>><br>
> >>>><br>
> >>>>Please consider the environment before printing this email.<br>
> >>>>_______________________________________________<br>
> >>>>OpenStack-operators mailing list<br>
> >>>><a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
> >>>><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
> >>>><br>
> >>>><br>
> >>>><br>
> >>><br>
> >>>_______________________________________________<br>
> >>>OpenStack-operators mailing list<br>
> >>><a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
> >>><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
> >>><br>
> >><br>
> >><br>
> >><br>
> >>--<br>
> >><br>
> >>Lorin Hochstein<br>
> >><br>
> >>Lead Architect - Cloud Services<br>
> >>Nimbis Services, Inc.<br>
> >><a href="http://www.nimbisservices.com/" target="_blank">www.nimbisservices.com</a><br>
> >><br>
> >><br>
><br>
> _______________________________________________<br>
> OpenStack-operators mailing list<br>
> <a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
><br>
><br>
<br>
<br>
--<br>
Lorin Hochstein<br>
Lead Architect - Cloud Services<br>
Nimbis Services, Inc.<br>
<a href="http://www.nimbisservices.com/" target="_blank">www.nimbisservices.com</a><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openstack.org/pipermail/openstack-operators/attachments/20130904/b53856f5/attachment-0001.html" target="_blank">http://lists.openstack.org/pipermail/openstack-operators/attachments/20130904/b53856f5/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
OpenStack-operators mailing list<br>
<a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
<br>
<br>
End of OpenStack-operators Digest, Vol 35, Issue 5<br>
**************************************************<br>
</blockquote></div><br></div></div>
_______________________________________________<br>OpenStack-operators mailing list<br><a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators<br></blockquote></div><br></body></html>