<div dir="ltr">Thanks Kris, issue resolved after adding below lines to sysctl.conf<div><br></div><div><div>net.bridge.bridge-nf-call-iptables = 1</div><div>net.bridge.bridge-nf-call-arptables = 1</div><div>net.bridge.bridge-nf-call-ip6tables = 1</div></div><div><br></div><div><br></div><div>appreciate your help, thanks a lot again.</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 21, 2016 at 8:25 PM, Kris G. Lindgren <span dir="ltr"><<a href="mailto:klindgren@godaddy.com" target="_blank">klindgren@godaddy.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>
<div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
Make sure that the bridges are being created (1 bridge per vm) they should be named close to the vm tap device name. Then make sure that you have bridge nf-call-* files enabled:</div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<br>
</div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<a href="http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf" target="_blank">http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf</a></div>
<div>
<div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<font color="#000000"><font face="Calibri"><br>
</font></font></div>
<div><font color="#000000"><font>Under hybrid mode what happens is a linux bridge (not an ovs bridge (brctl)) is created per vm. T</font>h<font face="Calibri" style="font-family:Calibri,sans-serif">e vm's tap device is plugged into
this bridge. A veth is created that spans from the vm's linux bridge to br-int and is plugged at both ends. This is done because older versions of OVS did not have support (or </font><font face="Calibri,sans-serif">efficient</font><font face="Calibri" style="font-family:Calibri,sans-serif"> support)
for doing firewalling. The problem is that in the kernel, packets traversing the Openvswitch code paths are unable to be hooked into by netfilter. So the linux </font><font face="Calibri,sans-serif">bridge</font><font face="Calibri"><font face="Calibri,sans-serif"> is
created </font>solely<font face="Calibri,sans-serif"> to allow the VM traffic to pass through a netfilter </font></font>hookable<font face="Calibri,sans-serif" style="font-family:Calibri"> location, so security groups work.</font></font></div>
<div><font color="#000000"><font face="Calibri,sans-serif" style="font-family:Calibri"><br>
</font></font></div>
<div><font color="#000000"><font>You need at a minimum to make sure /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1. If its not then when you look at the iptables rules that are created – you will see that none of the security
group chains are seeing traffic.</font></font></div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<font color="#000000"><font face="Calibri">___________________________________________________________________</font></font></div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<font color="#000000"><font face="Calibri">Kris Lindgren</font></font></div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<font color="#000000"><font face="Calibri">Senior Linux Systems Engineer</font></font></div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<font color="#000000"><font face="Calibri">GoDaddy</font></font></div>
</div>
</div>
</div>
</div>
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<br>
</div>
<span style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px">
<div style="font-family:Calibri;font-size:12pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>raju <<a href="mailto:raju.roks@gmail.com" target="_blank">raju.roks@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, April 21, 2016 at 5:26 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.openstack.org</a>" <<a href="mailto:openstack-operators@lists.openstack.org" target="_blank">openstack-operators@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[Openstack-operators] Security group rules not working on instances kilo<br>
</div><div><div class="h5">
<div><br>
</div>
<div>
<div>
<div dir="ltr">Hi,
<div><br>
</div>
<div>I am running into a issue where security group rules are not applying to instances when I create a new security group with default rules it should reject all incoming traffic but it is allowing everything without blocking</div>
<div><br>
</div>
<div>here is my config for nova :</div>
<div><br>
</div>
<div>security_group_api = neutron<br>
</div>
<div>firewall_driver = nova.virt.firewall.NoopFirewallDriver<br>
</div>
<div><br>
</div>
<div>and in ml2.con.ini</div>
<div><br>
</div>
<div>firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver<br>
</div>
<div><br>
</div>
<div>iptables service is running on all the nodes, please suggest me if I miss anything.</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks.</div>
</div>
</div>
</div>
</div></div></span>
</div>
</blockquote></div><br></div>