<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">You could tell dnsmasq to use your router as the gateway instead of the network host and then not allow routing across vlans.<div><br></div><div>To use an external gateway use a config option like the following:</div><div><span class="Apple-style-span" style="font-size: 12px; ">dnsmasq_config_file=/path/to/config</span></div><div><span class="Apple-style-span" style="font-size: 12px; "><br></span></div><div><span class="Apple-style-span" style="font-size: 12px; ">in that config file you can use:</span></div><div><span class="Apple-style-span" style="font-size: 12px; ">dhcp_option=3,<ip of router> to force vms to use your router as their gateway.</span></div><div><br></div><div>Vish</div><div><br><div><div><div>On Jun 1, 2012, at 10:30 PM, romizhang1968 wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="line-height:1.7;color:#000000;font-size:14px;font-family:arial">Vish,<div><br></div><div>Thanks for your replay.</div><div>Yes,I allowed icmp ping from 0.0.0.0/0, but the question is , i think the different instance in different tenant and vlan on the same compute node should not touch each other, admin03(192.168.2.3) in VLAN 200 and 201 should only could get ip touch to the same tenant instance, should not can touch aipu01(192.168.3.3) in VLAN 300 and aipuTenant even on the same compute node.</div><div>I check the route table, openstack creates route item to each bridge on the node, but in admin03,the route table only shows about how to go 192.168.2.0 and 192.168.21.0, have no way to touch the net of 192.168.3.0. but in admin03,it could ping aipu01, that means it use the node route table, i did not know why.</div><div>so I want to know is there a way in openstack command to stop this situation, not replay me to delete the compute node route item. and I think, each VM should connect to the "access port" and go through trunk port(eth1 or eth2) to communicate with others.</div><div>here is my wants. </div><div>regards,</div><div>Romi</div><div><br><br><div></div><div id="divNeteaseMailCard"></div><br>At 2012-06-02 00:47:49,"Vishvananda Ishaya" <<a href="mailto:vishvananda@gmail.com">vishvananda@gmail.com</a>> wrote:<br> <blockquote id="isReplyContent" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Broadcast traffic should be blocked via the vlan separation and direct traffic should be blocked via security groups. Do you have a security group that allows ping traffic from 0.0.0.0/0?<div><br></div><div>Vish</div><div><br><div><div>On Jun 1, 2012, at 1:38 AM, romi zhang wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="ZH-CN" link="blue" vlink="purple" style="font-family: Helvetica; line-height: normal; font-size: medium; "><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US">Hi,<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US">I use following command to create 2 NICs for the instances of adminTenant and 1 NICs for aipuTenant:<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US">nova-manage network create --label=admin_web --fixed_range_v4=192.168.2.0/28 --num_networks=1 --vlan=200 --bridge=br200 --bridge_interface=eth1 --network_size=16 --multi_host=T --project_id=5f9281bca6854fe3974a457d81afd78c<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US">nova-manage network create --label=admin_ssl --fixed_range_v4=192.168.21.0/28 --num_networks=1 --vlan=201 --bridge=br201 --bridge_interface=eth2 --network_size=16 --multi_host=T --project_id=5f9281bca6854fe3974a457d81afd78c<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US">nova-manage network create --label=aipu_web --fixed_range_v4=192.168.3.0/28 --num_networks=1 --vlan=300 --bridge=br300 --bridge_interface=eth1 --network_size=16 --multi_host=T --project_id=ee29f5730caa40958bf4812a0fbec3d9<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US">But the result is:<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 18pt; margin-bottom: 0.0001pt; text-align: left; text-indent: -18pt; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><span>1.<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span lang="EN-US">the instance of<span class="Apple-converted-space"> </span></span><span lang="EN-US" style="font-family: SimSun; ">admin03(192.168.2.3 192.168.21.3,belong adminTenant) could successfully ping aipu01(192.168.3.3,belong aipuTenant) on the same compute node(NC01,network+compute service) .<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 18pt; margin-bottom: 0.0001pt; text-align: left; text-indent: -18pt; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><span>2.<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span lang="EN-US" style="font-family: SimSun; ">Of course,admin03 could not ping successfully aipu03(192.168.3.6) on the another compute node(NC02,network+compute service).<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-family: SimSun; "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-family: SimSun; ">Is there a way or setting to forbid the IP touching between the instances of different tenant in different bridges and VLANs on the same compute node?<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-family: SimSun; "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: left; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-family: SimSun; ">Romi<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif; "><span lang="EN-US"><o:p> </o:p></span></div></div>_______________________________________________<br>Mailing list:<span class="Apple-converted-space"> </span><a href="https://launchpad.net/~openstack" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>Post to :<span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><br>Unsubscribe :<span class="Apple-converted-space"> </span><a href="https://launchpad.net/~openstack" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>More help :<span class="Apple-converted-space"> </span><a href="https://help.launchpad.net/ListHelp" style="color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><br></div></blockquote></div><br></div></blockquote></div></div><br><br><span title="neteasefooter"><span id="netease_mail_footer"></span></span></blockquote></div><br></div></div></body></html>