<font class="Apple-style-span" color="#333333" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse;"><span class="Apple-style-span" style="color: rgb(255, 255, 255); font-family: Georgia, Utopia, 'Palatino Linotype', Palatino, serif; font-size: 13px; line-height: 18px; border-collapse: separate; "><b><span class="Apple-style-span" style="color: rgb(68, 68, 68); ">#iptables -t nat -A nova-network-POSTROUTING -s <a href="http://10.0.0.0/12">10.0.0.0/12</a> -d <a href="http://192.168.1.0/24">192.168.1.0/24</a> -j ACCEPT</span></b></span></span></font><div>
<font class="Apple-style-span" color="#444444" face="Georgia, Utopia, 'Palatino Linotype', Palatino, serif"><span class="Apple-style-span" style="line-height: 18px;"><b><br></b></span></font></div><div><b></b><font class="Apple-style-span" color="#444444" face="Georgia, Utopia, 'Palatino Linotype', Palatino, serif"><span class="Apple-style-span" style="line-height: 18px;"><b>That's what I did on nova-network host .</b></span></font></div>
<div><font class="Apple-style-span" color="#444444" face="Georgia, Utopia, 'Palatino Linotype', Palatino, serif"><span class="Apple-style-span" style="line-height: 18px;"><b><br></b></span></font></div><div><font class="Apple-style-span" color="#444444" face="Georgia, Utopia, 'Palatino Linotype', Palatino, serif"><span class="Apple-style-span" style="line-height: 18px;"><b>btw , I always isolate nova-network.</b></span></font></div>
<div><b style="color: rgb(68, 68, 68); font-family: Georgia, Utopia, 'Palatino Linotype', Palatino, serif; line-height: 18px; ">I'm interesting about </b><b style="line-height: 18px; border-collapse: collapse;"><font class="Apple-style-span" color="#333333" face="arial, sans-serif">quagga in your environment.</font></b><br>
<br><div class="gmail_quote">2011/5/11 Narayan Desai <span dir="ltr"><<a href="mailto:narayan.desai@gmail.com">narayan.desai@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
For what it's worth, we're running in a configuration similar to the<br>
one in the attached diagram using VlanManager. When we moved the<br>
nova-network service off of the machine with nova-api, we needed to<br>
add an additional prerouting rule on the network server that prevented<br>
the traffic from being sent out via NAT (which caused the source<br>
address to be lost, resulting in a metadata resolution error). Once<br>
the packets arrive at the api service with the correct source address,<br>
they need a route back, via the nova-network server in order to get<br>
the response packets onto the correct vlan. With a single nova-network<br>
server, a static route will do. With multiple nova-network instances<br>
on different systems, things get a little more complicated. We ended<br>
up setting up route distribution via quagga between the nova-api<br>
server, and the nova-network servers. This ensures that nova-api knows<br>
which nova-network instance to use to reach any particular project<br>
network.<br>
-nld<br>
<div><div></div><div class="h5"><br>
On Tue, May 10, 2011 at 9:08 PM, ³ΆΔ£ΑΎ <<a href="mailto:tonytkdk@gmail.com">tonytkdk@gmail.com</a>> wrote:<br>
> Hello , guys<br>
> There's a problem while separate instance's network and nova-management<br>
> network.<br>
> EX.<br>
> Nova management network : <a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a> eth0<br>
> Instance network : <a href="http://10.0.0.0/12" target="_blank">10.0.0.0/12</a> eth1 bridge to br100<br>
> During cloud-setup :<br>
> Instance try to retrieve metadata from 169.254.169.254.<br>
> Instances(<a href="http://10.0.0.0/12" target="_blank">10.0.0.0/12</a>) request 169.254.169.254 PREROUTING from<br>
> gateway(nova-network).<br>
> But If PREROUTING rule is already been set on nova-Compute node, instance<br>
> request will be redirected on VM host instead of nova-network host.<br>
> So If your topology is like A diadram from StackOps , Plz Check iptables<br>
> rule on Compute nodes.<br>
> -A PREROUTING -d <a href="http://169.254.169.254/32" target="_blank">169.254.169.254/32</a> -p tcp -m tcp --dport 80 -j DNAT<br>
> --to-destination <a href="http://192.168.1.2:8773" target="_blank">192.168.1.2:8773</a><br>
> And del this rule , your instance will get metadata correctly....<br>
><br>
><br>
><br>
><br>
</div></div>> _______________________________________________<br>
> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
> Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
><br>
><br>
</blockquote></div><br></div>