<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>
<div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
Make sure that the bridges are being created (1 bridge per vm) they should be named close to the vm tap device name. Then make sure that you have bridge nf-call-* files enabled:</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
http://wiki.libvirt.org/page/Net.bridge.bridge-nf-call_and_sysctl.conf</div>
<div>
<div id="">
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri"><br>
</font></font></div>
<div><font class="Apple-style-span" color="#000000"><font>Under hybrid mode what happens is a linux bridge (not an ovs bridge (brctl)) is created per vm. T</font>h<font face="Calibri" style="font-family: Calibri, sans-serif;">e vm's tap device is plugged into
this bridge. A veth is created that spans from the vm's linux bridge to br-int and is plugged at both ends. This is done because older versions of OVS did not have support (or </font><font face="Calibri,sans-serif">efficient</font><font face="Calibri" style="font-family: Calibri, sans-serif;"> support)
for doing firewalling. The problem is that in the kernel, packets traversing the Openvswitch code paths are unable to be hooked into by netfilter. So the linux </font><font face="Calibri,sans-serif">bridge</font><font face="Calibri"><font face="Calibri,sans-serif"> is
created </font>solely<font face="Calibri,sans-serif"> to allow the VM traffic to pass through a netfilter </font></font>hookable<font face="Calibri,sans-serif" style="font-family: Calibri;"> location, so security groups work.</font></font></div>
<div><font class="Apple-style-span" color="#000000"><font face="Calibri,sans-serif" style="font-family: Calibri;"><br>
</font></font></div>
<div><font class="Apple-style-span" color="#000000"><font>You need at a minimum to make sure /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1. If its not then when you look at the iptables rules that are created – you will see that none of the security
group chains are seeing traffic.</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">___________________________________________________________________</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Kris Lindgren</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Senior Linux Systems Engineer</font></font></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">GoDaddy</font></font></div>
</div>
</div>
</div>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>raju <<a href="mailto:raju.roks@gmail.com">raju.roks@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, April 21, 2016 at 5:26 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>" <<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[Openstack-operators] Security group rules not working on instances kilo<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">Hi,
<div><br>
</div>
<div>I am running into a issue where security group rules are not applying to instances when I create a new security group with default rules it should reject all incoming traffic but it is allowing everything without blocking</div>
<div><br>
</div>
<div>here is my config for nova :</div>
<div><br>
</div>
<div>security_group_api = neutron<br>
</div>
<div>firewall_driver = nova.virt.firewall.NoopFirewallDriver<br>
</div>
<div><br>
</div>
<div>and in ml2.con.ini</div>
<div><br>
</div>
<div>firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver<br>
</div>
<div><br>
</div>
<div>iptables service is running on all the nodes, please suggest me if I miss anything.</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks.</div>
</div>
</div>
</div>
</span>
</body>
</html>