<div dir="ltr"><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Hi,</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">
I am using nova-network + VlanNetworkManage in Havana (2013.2.2). But I meet </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">following issue.</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">
<br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Different tenants can ping each other using fixed ip. I also found a bug fixed </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">
commit[1] about this. But it seems not work very well. It add following rule to the </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">iptables. (bond1 is the public_interface)</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">
<br></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -i br1000 -o br1000 -j ACCEPT</font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -i br1000 -o bond1 -j ACCEPT</font></div>
<div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -i br1000 -j DROP</font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -o br1000 -j DROP</font></div>
<div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -i br1001 -o br1001 -j ACCEPT</font></div><div class="gmail_default" style><span style="font-family:'trebuchet ms',sans-serif"> -A nova-network-FORWARD -i br1001 -o bond1 -j ACCEPT</span><font face="trebuchet ms, sans-serif"><br>
</font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -i br1001 -j DROP</font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"> -A nova-network-FORWARD -o br1001 -j DROP</font></div>
<div class="gmail_default" style><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif">It means drop the packages from br1000(tenant A) to br1001(tenant B). But I still </font></div>
<div class="gmail_default" style><font face="trebuchet ms, sans-serif">catch the package from br1000 to br1001 when using ping command.</font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"><br>
</font></div><div class="gmail_default" style><font face="trebuchet ms, sans-serif"><div class="gmail_default"> $ tcpdump -i br1000 -l -ne icmp</div><div class="gmail_default"> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div>
<div class="gmail_default"> listening on br1000, link-type EN10MB (Ethernet), capture size 65535 bytes</div><div class="gmail_default"> 22:30:46.541275 fa:16:3e:ef:45:75 > fa:16:3e:be:bf:f6, ethertype IPv4 (0x0800), length 98: 10.192.1.13 > <a href="http://10.192.2.18">10.192.2.18</a>: ICMP echo request, id 2690, seq 501, length 64</div>
<div class="gmail_default"> 22:30:46.541599 fa:16:3e:be:bf:f6 > fa:16:3e:ef:45:75, ethertype IPv4 (0x0800), length 98: 10.192.2.18 > <a href="http://10.192.1.13">10.192.1.13</a>: ICMP echo reply, id 2690, seq 501, length 64</div>
<div><br></div><div><br></div><div><div> $ tcpdump -i br1001 -l -ne icmp</div><div> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div><div> listening on br1001, link-type EN10MB (Ethernet), capture size 65535 bytes</div>
<div> 22:31:11.540675 fa:16:3e:b8:92:e6 > fa:16:3e:96:d9:18, ethertype IPv4 (0x0800), length 98: 10.192.1.13 > <a href="http://10.192.2.18">10.192.2.18</a>: ICMP echo request, id 2690, seq 526, length 64</div><div>
22:31:11.540937 fa:16:3e:96:d9:18 > fa:16:3e:b8:92:e6, ethertype IPv4 (0x0800), length 98: 10.192.2.18 > <a href="http://10.192.1.13">10.192.1.13</a>: ICMP echo reply, id 2690, seq 526, length 64</div></div><div>
<br></div></font></div><div><br></div><div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Does anybody can explain and tell me how to fix it?</div><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">
<br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">[1] <a href="https://review.openstack.org/#/c/20362/">https://review.openstack.org/#/c/20362/</a></div><div><br></div>-- <br><div dir="ltr">
<div><span style="font-size:13px;border-collapse:collapse"><font face="trebuchet ms, sans-serif">Lei Zhang</font></span></div><div><font face="trebuchet ms, sans-serif">Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a></font></div>
<div><font face="trebuchet ms, sans-serif">twitter/weibo: @jeffrey4l</font></div></div>
</div>