<div dir="ltr"><div class="markdown-here-wrapper" id="markdown-here-wrapper-51800" style="font-size:1em;font-family:Helvetica,arial,freesans,clean,sans-serif;color:rgb(34,34,34);background-color:rgb(255,255,255);border:none;line-height:1.2">
<p style="margin:1em 0px">Hi all, </p>
<p style="margin:1em 0px">I am testing the nova-network + vlan + multi_host. But I found that the ip_forward is enable automatically when launch new instances. You can check the code <a href="https://github.com/openstack/nova/blob/master/nova/network/linux_net.py#L770" style="color:rgb(51,51,238);text-decoration:none">https://github.com/openstack/nova/blob/master/nova/network/linux_net.py#L770</a> </p>
<p style="margin:1em 0px">I found there is some issue seriously when the ip_forward=1 on compute node. Here my testing process</p>
<p style="margin:1em 0px">Controller:</p>
<pre style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;font-size:1em;line-height:1.2em;overflow:auto;margin:1em 0px"><code style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;margin:0px 0.15em;padding:0px 0.3em;white-space:nowrap;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;display:inline;white-space:pre;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;border:1px solid rgb(204,204,204);padding:0.5em 0.7em;display:block;padding:0.5em;color:rgb(51,51,51);background-color:rgb(248,248,255);background-repeat:initial initial">[root@openstack-controller conf.d]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet <a href="http://127.0.0.1/8">127.0.0.1/8</a> scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: p3p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 90:b1:1c:0d:87:79 brd ff:ff:ff:ff:ff:ff
inet <a href="http://192.168.3.10/24">192.168.3.10/24</a> brd 192.168.3.255 scope global p3p1
inet6 fe80::92b1:1cff:fe0d:8779/64 scope link
valid_lft forever preferred_lft forever
3: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 90:b1:1c:0d:87:7a brd ff:ff:ff:ff:ff:ff
inet <a href="http://172.16.0.10/24">172.16.0.10/24</a> brd 172.16.0.255 scope global em1
inet6 fe80::92b1:1cff:fe0d:877a/64 scope link
valid_lft forever preferred_lft forever</code></pre>
<p style="margin:1em 0px">Computer Node:</p>
<pre style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;font-size:1em;line-height:1.2em;overflow:auto;margin:1em 0px"><code style="font-size:0.85em;font-family:Consolas,Inconsolata,Courier,monospace;margin:0px 0.15em;padding:0px 0.3em;white-space:nowrap;border:1px solid rgb(234,234,234);background-color:rgb(248,248,248);border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;display:inline;white-space:pre;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px;border:1px solid rgb(204,204,204);padding:0.5em 0.7em;display:block;padding:0.5em;color:rgb(51,51,51);background-color:rgb(248,248,255);background-repeat:initial initial">[root@openstack-node2 vlan]# ip a
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 90:b1:1c:0d:73:ea brd ff:ff:ff:ff:ff:ff
inet <a href="http://172.16.0.12/24">172.16.0.12/24</a> brd 172.16.0.255 scope global em1
inet6 fe80::92b1:1cff:fe0d:73ea/64 scope link
valid_lft forever preferred_lft forever
4: p3p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 00:10:18:f7:4a:34 brd ff:ff:ff:ff:ff:ff
inet <a href="http://192.168.3.12/24">192.168.3.12/24</a> brd 192.168.3.255 scope global p3p1
inet <a href="http://192.168.3.33/32">192.168.3.33/32</a> scope global p3p1
inet6 fe80::210:18ff:fef7:4a34/64 scope link
valid_lft forever preferred_lft forever
9: vlan102@em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether fa:16:3e:54:ea:11 brd ff:ff:ff:ff:ff:ff
inet6 fe80::f816:3eff:fe54:ea11/64 scope link
valid_lft forever preferred_lft forever
10: br102: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:54:ea:11 brd ff:ff:ff:ff:ff:ff
inet <a href="http://10.0.102.4/24">10.0.102.4/24</a> brd 10.0.102.255 scope global br102
inet6 fe80::2816:24ff:feb5:5770/64 scope link
valid_lft forever preferred_lft forever
11: vlan103@em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether fa:16:3e:3a:a0:20 brd ff:ff:ff:ff:ff:ff
inet6 fe80::f816:3eff:fe3a:a020/64 scope link
valid_lft forever preferred_lft forever
12: br103: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether fa:16:3e:3a:a0:20 brd ff:ff:ff:ff:ff:ff
inet <a href="http://10.0.103.4/24">10.0.103.4/24</a> brd 10.0.103.255 scope global br103
inet6 fe80::480c:f2ff:fe9b:a600/64 scope link
valid_lft forever preferred_lft forever
13: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/ether fe:16:3e:0c:65:73 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc16:3eff:fe0c:6573/64 scope link
valid_lft forever preferred_lft forever
15: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/ether fe:16:3e:7f:a2:d5 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc16:3eff:fe7f:a2d5/64 scope link
valid_lft forever preferred_lft forever
16: vnet2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/ether fe:16:3e:31:8f:7c brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc16:3eff:fe31:8f7c/64 scope link
valid_lft forever preferred_lft forever
17: vnet3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/ether fe:16:3e:63:8c:e2 brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc16:3eff:fe63:8ce2/64 scope link
valid_lft forever preferred_lft forever
[root@openstack-node2 vlan]# brctl show
bridge name bridge id STP enabled interfaces
br102 8000.fa163e54ea11 no vlan102
vnet0
vnet1
vnet2
br103 8000.fa163e3aa020 no vlan103
vnet3
virbr0 8000.525400aaa1b5 yes virbr0-nic</code></pre>
<p style="margin:1em 0px">if the ip_forward=1, then vm1(vnet1) can ping vm2(vnet4) and controller can ping vm1(vnet1) and vm2(vnet4). this should be wrong.</p>
<p style="margin:1em 0px">Any body meet this error? and how to fix this except for changing the code. </p>
</div><div>-- <br><div><span style="font-family:arial,sans-serif;font-size:13px;border-collapse:collapse">Lei Zhang</span></div><div><span style="font-family:arial,sans-serif;font-size:13px;border-collapse:collapse"><br>
</span></div><div><font face="arial, sans-serif">Blog: <a href="http://jeffrey4l.github.com" target="_blank">http://jeffrey4l.github.com</a></font></div><div>twitter/weibo: @jeffrey4l</div>
</div></div>