<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">That means you shouldn't use iptables for your custom rules since OpenStack manages iptables and everytime the network is updated, iptables is impacted. If you restart nova-netork for instance, then all the iptables rules are flushed and recreated according to your network topology.<div>The iptables service doesn't need to be turned off (is that even possible?), just make sure not to create routing rules manually that might conflict with the rules OpenStack sets :)</div><div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="color: rgb(0, 0, 0); font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; border-collapse: separate; font-family: 'Lucida Grande'; border-spacing: 0px; -webkit-text-decorations-in-effect: none; "><span class="Apple-style-span" style="font-weight: normal; font-family: Helvetica; "><b style="color: rgb(19, 112, 138); ">Razique Mahroua</b></span><span class="Apple-style-span" style="font-weight: normal; font-family: Helvetica; color: rgb(19, 112, 138); "><b> - </b></span><span class="Apple-style-span" style="font-family: Helvetica; "><span class="Apple-style-span" style="font-weight: normal; font-family: Helvetica; "><b style="color: rgb(19, 112, 138); ">Nuage & Co</b></span><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; border-collapse: separate; border-spacing: 0px; -webkit-text-decorations-in-effect: none; "><span class="Apple-style-span" style="border-collapse: separate; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="font-weight: normal; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; "><font class="Apple-style-span" color="#13708a"><a href="mailto:razique.mahroua@gmail.com">razique.mahroua@gmail.com</a></font></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; "><font class="Apple-style-span" color="#13708a">Tel : +33 9 72 37 94 15</font></div></span></span></span></span></span><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Arial; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span><img height="125" width="125" id="16bdb943-45b5-4aa0-8e35-bdcd0f464b4f" apple-width="yes" apple-height="yes" src="cid:0A2450C8-6A0D-42D0-8035-743CAD564432@fabrique.lan"></span>
</div>
<br><div><div>Le 28 août 2013 à 19:08, Craig E. Ward <<a href="mailto:cward@isi.edu">cward@isi.edu</a>> a écrit :</div><br class="Apple-interchange-newline"><blockquote type="cite">I have an OpenStack Folsom, with Quantum networking, installation that I'm having trouble getting additional rules into the iptables on nova-compute nodes. The online manual (<a href="http://docs.openstack.org/trunk/openstack-ops/content/iptables.html">http://docs.openstack.org/trunk/openstack-ops/content/iptables.html</a>) states that "You must use OpenStack to manage iptables." What it doesn't include is any indication of how that is done. How can iptables be managed with OpenStack?<br><br>When I add rules to the file /etc/sysconfig/iptables, sometimes the nova-compute service fails to work properly. A new instance on the node may not get an IP address or the vnc service in Horizon does not respond. The instance is listed in the database with an assigned IP, but the address is not reachable.<br><br>Does the iptables service need to be "off" in the context of chkconfig? That is, don't let it start through the rc sequence, but let nova-compute start it and populate the rules?<br><br>If iptables is started in the rc sequence, then are there some rules that should not be in /etc/sysconfig/iptables?<br><br>If the rc sequence is not used, how do ports unrelated to OpenStack services get enabled?<br><br>Does the default response for a packet sent to non-OpenStack related port drop the packet or let it pass?<br><br>Thanks,<br><br>Craig<br><br><br>-- <br>Craig E. Ward<br>Information Sciences Institute<br>University of Southern California<br><a href="mailto:cward@ISI.EDU">cward@ISI.EDU</a><br><br><br>_______________________________________________<br>Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack<br>Post to : openstack@lists.openstack.org<br>Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack<br></blockquote></div><br></div></body></html>