<div dir="ltr">
<p class="MsoNormal">Hi,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Tried to ssh form the network node <span style> </span>to instance ..</p>
<p class="MsoNormal">Observed packets <span style> </span>ssh
packets are transmitted to and from . but connection is not established .</p>
<p class="MsoNormal">What may be the reason .? </p>
<p class="MsoNormal">Below are few dumps in the path<span style> </span>from external network of network node to
instance <span style> </span>.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">My instance overview is pasted at </p>
<p class="MsoNormal"><a href="http://paste.openstack.org/show/113366/">http://paste.openstack.org/show/113366/</a></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">root@user-ThinkCentre-M73:/home/user# ssh <a href="mailto:cirros@172.0.0.4">cirros@172.0.0.4</a>
-vvv</p>
<p class="MsoNormal">OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014</p>
<p class="MsoNormal">debug1: Reading configuration data /etc/ssh/ssh_config</p>
<p class="MsoNormal">debug1: /etc/ssh/ssh_config line 19: Applying options for *</p>
<p class="MsoNormal">debug2: ssh_connect: needpriv 0</p>
<p class="MsoNormal">debug1: Connecting to 172.0.0.4 [172.0.0.4] port 22.</p>
<p class="MsoNormal">debug1: Connection established.</p>
<p class="MsoNormal">debug1: permanently_set_uid: 0/0</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_rsa type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_rsa-cert type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_dsa type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_dsa-cert type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_ecdsa type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_ecdsa-cert type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_ed25519 type -1</p>
<p class="MsoNormal">debug1: identity file /root/.ssh/id_ed25519-cert type -1</p>
<p class="MsoNormal">debug1: Enabling compatibility mode for protocol 2.0</p>
<p class="MsoNormal">debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1
Ubuntu-2ubuntu2</p>
<p class="MsoNormal">debug1: Remote protocol version 2.0, remote software version
dropbear_2012.55</p>
<p class="MsoNormal">debug1: no match: dropbear_2012.55</p>
<p class="MsoNormal">debug2: fd 3 setting O_NONBLOCK</p>
<p class="MsoNormal">debug3: load_hostkeys: loading entries for host
"172.0.0.4" from file "/root/.ssh/known_hosts"</p>
<p class="MsoNormal">debug3: load_hostkeys: loaded 0 keys</p>
<p class="MsoNormal">debug1: SSH2_MSG_KEXINIT sent</p>
<p class="MsoNormal">debug1: SSH2_MSG_KEXINIT received</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
<a href="mailto:curve25519-sha256@libssh.org">curve25519-sha256@libssh.org</a>,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
<a href="mailto:ecdsa-sha2-nistp256-cert-v01@openssh.com">ecdsa-sha2-nistp256-cert-v01@openssh.com</a>,<a href="mailto:ecdsa-sha2-nistp384-cert-v01@openssh.com">ecdsa-sha2-nistp384-cert-v01@openssh.com</a>,<a href="mailto:ecdsa-sha2-nistp521-cert-v01@openssh.com">ecdsa-sha2-nistp521-cert-v01@openssh.com</a>,<a href="mailto:ssh-ed25519-cert-v01@openssh.com">ssh-ed25519-cert-v01@openssh.com</a>,<a href="mailto:ssh-rsa-cert-v01@openssh.com">ssh-rsa-cert-v01@openssh.com</a>,<a href="mailto:ssh-dss-cert-v01@openssh.com">ssh-dss-cert-v01@openssh.com</a>,<a href="mailto:ssh-rsa-cert-v00@openssh.com">ssh-rsa-cert-v00@openssh.com</a>,<a href="mailto:ssh-dss-cert-v00@openssh.com">ssh-dss-cert-v00@openssh.com</a>,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,<a href="mailto:aes128-gcm@openssh.com">aes128-gcm@openssh.com</a>,<a href="mailto:aes256-gcm@openssh.com">aes256-gcm@openssh.com</a>,<a href="mailto:chacha20-poly1305@openssh.com">chacha20-poly1305@openssh.com</a>,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a></p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,<a href="mailto:aes128-gcm@openssh.com">aes128-gcm@openssh.com</a>,<a href="mailto:aes256-gcm@openssh.com">aes256-gcm@openssh.com</a>,<a href="mailto:chacha20-poly1305@openssh.com">chacha20-poly1305@openssh.com</a>,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,<a href="mailto:rijndael-cbc@lysator.liu.se">rijndael-cbc@lysator.liu.se</a></p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
<a href="mailto:hmac-md5-etm@openssh.com">hmac-md5-etm@openssh.com</a>,<a href="mailto:hmac-sha1-etm@openssh.com">hmac-sha1-etm@openssh.com</a>,<a href="mailto:umac-64-etm@openssh.com">umac-64-etm@openssh.com</a>,<a href="mailto:umac-128-etm@openssh.com">umac-128-etm@openssh.com</a>,<a href="mailto:hmac-sha2-256-etm@openssh.com">hmac-sha2-256-etm@openssh.com</a>,<a href="mailto:hmac-sha2-512-etm@openssh.com">hmac-sha2-512-etm@openssh.com</a>,<a href="mailto:hmac-ripemd160-etm@openssh.com">hmac-ripemd160-etm@openssh.com</a>,<a href="mailto:hmac-sha1-96-etm@openssh.com">hmac-sha1-96-etm@openssh.com</a>,<a href="mailto:hmac-md5-96-etm@openssh.com">hmac-md5-96-etm@openssh.com</a>,hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,<a href="mailto:umac-128@openssh.com">umac-128@openssh.com</a>,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
<a href="mailto:hmac-md5-etm@openssh.com">hmac-md5-etm@openssh.com</a>,<a href="mailto:hmac-sha1-etm@openssh.com">hmac-sha1-etm@openssh.com</a>,<a href="mailto:umac-64-etm@openssh.com">umac-64-etm@openssh.com</a>,<a href="mailto:umac-128-etm@openssh.com">umac-128-etm@openssh.com</a>,<a href="mailto:hmac-sha2-256-etm@openssh.com">hmac-sha2-256-etm@openssh.com</a>,<a href="mailto:hmac-sha2-512-etm@openssh.com">hmac-sha2-512-etm@openssh.com</a>,<a href="mailto:hmac-ripemd160-etm@openssh.com">hmac-ripemd160-etm@openssh.com</a>,<a href="mailto:hmac-sha1-96-etm@openssh.com">hmac-sha1-96-etm@openssh.com</a>,<a href="mailto:hmac-md5-96-etm@openssh.com">hmac-md5-96-etm@openssh.com</a>,hmac-md5,hmac-sha1,<a href="mailto:umac-64@openssh.com">umac-64@openssh.com</a>,<a href="mailto:umac-128@openssh.com">umac-128@openssh.com</a>,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,<a href="mailto:hmac-ripemd160@openssh.com">hmac-ripemd160@openssh.com</a>,hmac-sha1-96,hmac-md5-96</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: none,<a href="mailto:zlib@openssh.com">zlib@openssh.com</a>,zlib</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: first_kex_follows 0</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: reserved 0</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: ssh-rsa,ssh-dss</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:
aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: aes128-ctr,3des-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: hmac-sha1-96,hmac-sha1,hmac-md5</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: hmac-sha1-96,hmac-sha1,hmac-md5</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: none</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: none</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:</p>
<p class="MsoNormal">debug2: kex_parse_kexinit:</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: first_kex_follows 0</p>
<p class="MsoNormal">debug2: kex_parse_kexinit: reserved 0</p>
<p class="MsoNormal">debug2: mac_setup: setup hmac-md5</p>
<p class="MsoNormal">debug1: kex: server->client aes128-ctr hmac-md5 none</p>
<p class="MsoNormal">debug2: mac_setup: setup hmac-md5</p>
<p class="MsoNormal">debug1: kex: client->server aes128-ctr hmac-md5 none</p>
<p class="MsoNormal">debug2: bits set: 1019/2048</p>
<p class="MsoNormal">debug1: sending SSH2_MSG_KEXDH_INIT</p>
<p class="MsoNormal">debug1: expecting SSH2_MSG_KEXDH_REPLY</p>
<p class="MsoNormal">Read from socket failed: Connection timed out</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<div style="border-width:medium medium 2.25pt;border-style:none none double;border-color:-moz-use-text-color -moz-use-text-color windowtext;padding:0in 0in 1pt">
<p class="MsoNormal" style="border:medium none;padding:0in"> </p>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size:14pt">Ifconfig of<span style> </span>router namespace in network node </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">root@user-ThinkCentre-M73:/home/user# ip netns exec
qrouter-f6e00f94-1c6d-4cf5-8cae-319e393240fe<span style>
</span>ifconfig</p>
<p class="MsoNormal">lo<span style> </span>Link
encap:Local Loopback</p>
<p class="MsoNormal"><span style> </span>inet
addr:127.0.0.1<span style> </span>Mask:255.0.0.0</p>
<p class="MsoNormal"><span style> </span>inet6 addr:
::1/128 Scope:Host</p>
<p class="MsoNormal"><span style> </span>UP LOOPBACK
RUNNING<span style> </span>MTU:65536<span style> </span>Metric:1</p>
<p class="MsoNormal"><span style> </span>RX
packets:48 errors:0 dropped:0 overruns:0 frame:0</p>
<p class="MsoNormal"><span style> </span>TX
packets:48 errors:0 dropped:0 overruns:0 carrier:0</p>
<p class="MsoNormal"><span style> </span>collisions:0
txqueuelen:0</p>
<p class="MsoNormal"><span style> </span>RX
bytes:3924 (3.9 KB)<span style> </span>TX bytes:3924 (3.9
KB)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">qg-ec80d9fb-82 Link encap:Ethernet<span style> </span>HWaddr fa:16:3e:b4:4e:6e</p>
<p class="MsoNormal"><span style> </span>inet
addr:172.0.0.2<span style> </span>Bcast:172.0.0.255<span style> </span>Mask:255.255.255.0</p>
<p class="MsoNormal"><span style> </span>inet6 addr:
fe80::f816:3eff:feb4:4e6e/64 Scope:Link</p>
<p class="MsoNormal"><span style> </span>UP BROADCAST
RUNNING<span style> </span>MTU:1500<span style> </span>Metric:1</p>
<p class="MsoNormal"><span style> </span>RX
packets:1222 errors:0 dropped:0 overruns:0 frame:0</p>
<p class="MsoNormal"><span style> </span>TX
packets:1105 errors:0 dropped:0 overruns:0 carrier:0</p>
<p class="MsoNormal"><span style> </span>collisions:0
txqueuelen:0</p>
<p class="MsoNormal"><span style> </span>RX
bytes:345583 (345.5 KB)<span style> </span>TX bytes:112480
(112.4 KB)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">qr-72d38d5b-5c Link encap:Ethernet<span style> </span>HWaddr fa:16:3e:6a:fd:ce</p>
<p class="MsoNormal"><span style> </span>inet
addr:11.0.0.1<span style> </span>Bcast:11.0.0.255<span style> </span>Mask:255.255.255.0</p>
<p class="MsoNormal"><span style> </span>inet6 addr:
fe80::f816:3eff:fe6a:fdce/64 Scope:Link</p>
<p class="MsoNormal"><span style> </span>UP BROADCAST
RUNNING<span style> </span>MTU:1500<span style> </span>Metric:1</p>
<p class="MsoNormal"><span style> </span>RX
packets:19529 errors:0 dropped:0 overruns:0 frame:0</p>
<p class="MsoNormal"><span style> </span>TX
packets:1283 errors:0 dropped:0 overruns:0 carrier:0</p>
<p class="MsoNormal"><span style> </span>collisions:0
txqueuelen:0</p>
<p class="MsoNormal"><span style> </span>RX
bytes:3046631 (3.0 MB)<span style> </span>TX bytes:349969
(349.9 KB)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<div style="border-width:medium medium 2.25pt;border-style:none none double;border-color:-moz-use-text-color -moz-use-text-color windowtext;padding:0in 0in 1pt">
<p class="MsoNormal" style="border:medium none;padding:0in"> </p>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size:14pt">Tcpdump at interface
connected to external bridge [ br-ex ] on network node .</span></p>
<p class="MsoNormal"><span style="font-size:14pt"> </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">root@user-ThinkCentre-M73:/home/user# ip netns exec
qrouter-f6e00f94-1c6d-4cf5-8cae-319e393240fe<span style>
</span>tcpdump -i qg-ec80d9fb-82</p>
<p class="MsoNormal">tcpdump: verbose output suppressed, use -v or -vv for full
protocol decode</p>
<p class="MsoNormal">listening on qg-ec80d9fb-82, link-type EN10MB (Ethernet),
capture size 65535 bytes</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">^C05:48:45.486622 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [S], seq 3976398776, win 29200, options [mss 1460,sackOK,TS val 4692954
ecr 0,nop,wscale 7], length 0</p>
<p class="MsoNormal">05:48:45.487671 IP 172.0.0.4.ssh > 172.0.0.117.55818:
Flags [S.], seq 3831484282, ack 3976398777, win 14480, options [mss
1460,sackOK,TS val 44193412 ecr 4692954,nop,wscale 3], length 0</p>
<p class="MsoNormal">05:48:45.487720 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], ack 1, win 229, options [nop,nop,TS val 4692954 ecr 44193412],
length 0</p>
<p class="MsoNormal">05:48:45.488031 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [P.], seq 1:42, ack 1, win 229, options [nop,nop,TS val 4692954 ecr
44193412], length 41</p>
<p class="MsoNormal">05:48:45.488678 IP 172.0.0.4.ssh > 172.0.0.117.55818:
Flags [.], ack 42, win 1810, options [nop,nop,TS val 44193412 ecr 4692954],
length 0</p>
<p class="MsoNormal">05:48:45.488933 IP 172.0.0.4.ssh > 172.0.0.117.55818:
Flags [P.], seq 1:27, ack 42, win 1810, options [nop,nop,TS val 44193412 ecr
4692954], length 26</p>
<p class="MsoNormal">05:48:45.488992 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], ack 27, win 229, options [nop,nop,TS val 4692954 ecr 44193412],
length 0</p>
<p class="MsoNormal">05:48:45.489245 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 27, win 229, options [nop,nop,TS val 4692954 ecr
44193412], length 1448</p>
<p class="MsoNormal">05:48:45.489290 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [P.], seq 1490:2010, ack 27, win 229, options [nop,nop,TS val 4692954 ecr
44193412], length 520</p>
<p class="MsoNormal">05:48:45.489847 IP 172.0.0.4.ssh > 172.0.0.117.55818:
Flags [P.], seq 27:443, ack 42, win 1810, options [nop,nop,TS val 44193412 ecr
4692954], length 416</p>
<p class="MsoNormal">05:48:45.490316 IP 172.0.0.4.ssh > 172.0.0.117.55818:
Flags [.], ack 42, win 1810, options [nop,nop,TS val 44193412 ecr
4692954,nop,nop,sack 1 {1490:2010}], length 0</p>
<p class="MsoNormal">05:48:45.490386 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4692955 ecr
44193412], length 1448</p>
<p class="MsoNormal">05:48:45.691646 IP 172.0.0.4.ssh > 172.0.0.117.55818:
Flags [P.], seq 27:443, ack 42, win 1810, options [nop,nop,TS val 44193463 ecr
4692954,nop,nop,sack 1 {1490:2010}], length 416</p>
<p class="MsoNormal">05:48:45.691690 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], ack 443, win 237, options [nop,nop,TS val 4693005 ecr
44193463,nop,nop,sack 1 {27:443}], length 0</p>
<p class="MsoNormal">05:48:45.694466 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4693006 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:48:46.102461 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4693108 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:48:46.918464 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4693312 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:48:48.554444 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4693721 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:48:50.502461 ARP, Request who-has 172.0.0.117 tell 172.0.0.2,
length 28</p>
<p class="MsoNormal">05:48:50.502547 ARP, Request who-has 172.0.0.4 tell
172.0.0.117, length 28</p>
<p class="MsoNormal">05:48:50.502559 ARP, Reply 172.0.0.4 is-at fa:16:3e:b4:4e:6e
(oui Unknown), length 28</p>
<p class="MsoNormal">05:48:50.502597 ARP, Reply 172.0.0.117 is-at
68:05:ca:0e:6b:b6 (oui Unknown), length 28</p>
<p class="MsoNormal">05:48:51.830441 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4694540 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:48:58.374756 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4696176 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:49:11.462560 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4699448 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:49:37.606548 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4705984 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:49:42.614737 ARP, Request who-has 172.0.0.4 tell
172.0.0.117, length 28</p>
<p class="MsoNormal">05:49:42.614769 ARP, Reply 172.0.0.4 is-at fa:16:3e:b4:4e:6e
(oui Unknown), length 28</p>
<p class="MsoNormal">05:50:29.958757 IP 172.0.0.117.55818 > 172.0.0.4.ssh:
Flags [.], seq 42:1490, ack 443, win 237, options [nop,nop,TS val 4719072 ecr
44193463], length 1448</p>
<p class="MsoNormal">05:50:34.966723 ARP, Request who-has 172.0.0.4 tell
172.0.0.117, length 28</p>
<p class="MsoNormal">05:50:34.966750 ARP, Reply 172.0.0.4 is-at fa:16:3e:b4:4e:6e
(oui Unknown), length 28</p>
<div style="border-width:medium medium 2.25pt;border-style:none none double;border-color:-moz-use-text-color -moz-use-text-color windowtext;padding:0in 0in 1pt">
<p class="MsoNormal" style="border:medium none;padding:0in"> </p>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size:14pt">Tcpdump at tap interface
connected to instance<span style> </span>at compute
node<span style> </span>.</span></p>
<p class="MsoNormal"><span style="font-size:14pt">This tap interface is
connected to br-int on compute node . </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">root@user-ThinkCentre-M73:/home/user# tcpdump -i
tapb0373360-21 port 22</p>
<p class="MsoNormal">tcpdump: WARNING: tapb0373360-21: no IPv4 address assigned</p>
<p class="MsoNormal">tcpdump: verbose output suppressed, use -v or -vv for full
protocol decode</p>
<p class="MsoNormal">listening on tapb0373360-21, link-type EN10MB (Ethernet),
capture size 65535 bytes</p>
<p class="MsoNormal">05:49:00.295624 IP 172.0.0.117.55818 > 11.0.0.5.ssh:
Flags [S], seq 3976398776, win 29200, options [mss 1460,sackOK,TS val 4692954
ecr 0,nop,wscale 7], length 0</p>
<p class="MsoNormal">05:49:00.295758 IP 11.0.0.5.ssh > 172.0.0.117.55818:
Flags [S.], seq 3831484282, ack 3976398777, win 14480, options [mss
1460,sackOK,TS val 44193412 ecr 4692954,nop,wscale 3], length 0</p>
<p class="MsoNormal">05:49:00.296464 IP 172.0.0.117.55818 > 11.0.0.5.ssh:
Flags [.], ack 1, win 229, options [nop,nop,TS val 4692954 ecr 44193412],
length 0</p>
<p class="MsoNormal">05:49:00.296738 IP 172.0.0.117.55818 > 11.0.0.5.ssh:
Flags [P.], seq 1:42, ack 1, win 229, options [nop,nop,TS val 4692954 ecr
44193412], length 41</p>
<p class="MsoNormal">05:49:00.296798 IP 11.0.0.5.ssh > 172.0.0.117.55818:
Flags [.], ack 42, win 1810, options [nop,nop,TS val 44193412 ecr 4692954],
length 0</p>
<p class="MsoNormal">05:49:00.297069 IP 11.0.0.5.ssh > 172.0.0.117.55818:
Flags [P.], seq 1:27, ack 42, win 1810, options [nop,nop,TS val 44193412 ecr
4692954], length 26</p>
<p class="MsoNormal">05:49:00.297122 IP 11.0.0.5.ssh > 172.0.0.117.55818:
Flags [P.], seq 27:443, ack 42, win 1810, options [nop,nop,TS val 44193412 ecr
4692954], length 416</p>
<p class="MsoNormal">05:49:00.297717 IP 172.0.0.117.55818 > 11.0.0.5.ssh:
Flags [.], ack 27, win 229, options [nop,nop,TS val 4692954 ecr 44193412],
length 0</p>
<p class="MsoNormal">05:49:00.298022 IP 172.0.0.117.55818 > 11.0.0.5.ssh:
Flags [P.], seq 1490:2010, ack 27, win 229, options [nop,nop,TS val 4692954 ecr
44193412], length 520</p>
<p class="MsoNormal">05:49:00.298073 IP 11.0.0.5.ssh > 172.0.0.117.55818:
Flags [.], ack 42, win 1810, options [nop,nop,TS val 44193412 ecr
4692954,nop,nop,sack 1 {1490:2010}], length 0</p>
<p class="MsoNormal">05:49:00.498896 IP 11.0.0.5.ssh > 172.0.0.117.55818: Flags
[P.], seq 27:443, ack 42, win 1810, options [nop,nop,TS val 44193463 ecr
4692954,nop,nop,sack 1 {1490:2010}], length 416</p>
<p class="MsoNormal">05:49:00.500531 IP 172.0.0.117.55818 > 11.0.0.5.ssh:
Flags [.], ack 443, win 237, options [nop,nop,TS val 4693005 ecr 44193463,nop,nop,sack
1 {27:443}], length 0</p>
<p class="MsoNormal"> </p>
<div style="border-width:medium medium 2.25pt;border-style:none none double;border-color:-moz-use-text-color -moz-use-text-color windowtext;padding:0in 0in 1pt">
<p class="MsoNormal" style="border:medium none;padding:0in"> </p>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,</p>
<p class="MsoNormal">Srinivas.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 19, 2014 at 3:32 PM, Raghu Vadapalli <span dir="ltr"><<a href="mailto:rvatspacket@gmail.com" target="_blank">rvatspacket@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span>Just to confirm if iptables are the issue try stopping iptables and see if it works and then you can debug further.</span><div>—<br>Sent from <a href="https://www.dropbox.com/mailbox" target="_blank">Mailbox</a>
</div><div class="HOEnZb"><div class="h5">
<br><br><div class="gmail_quote"><p>On Fri, Sep 19, 2014 at 3:55 AM, Srinivasreddy R <span dir="ltr"><<a href="mailto:srinivasreddy4390@gmail.com" target="_blank">srinivasreddy4390@gmail.com</a>></span> wrote:<br></p><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">
<div>
<div>
<div>hi,<br></div>i had addeed a rule for (ingress, tcp, port 22 and cidr <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>). still not able to ssh .<br><br></div>
<div>my instance overview <br><a href="http://paste.openstack.org/show/113170/" target="_blank">http://paste.openstack.org/show/113170/</a><br><br></div>
<div><br></div>i pasted my ip tables [ nat, mangle,filter] output ..<br><br></div>please let me know i want to add or delete any thing in iptables .<br><div>
<div>
<br><a href="http://paste.openstack.org/show/113164/" target="_blank">http://paste.openstack.org/show/113164/</a><br><br><br></div>
<div>thanks,<br></div>
<div>srinivas.<br><br></div>
<div><br></div>
</div>
<div class="gmail_extra">
<br><div class="gmail_quote">On Fri, Sep 19, 2014 at 12:39 PM, Akilesh K <span dir="ltr"><<a href="mailto:akilesh1597@gmail.com" target="_blank">akilesh1597@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div>
<div>
<div>
<div>The mail from Andreas was correct you need to add a rule for (ingress, tcp, port 22 and cidr <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>). <br><br></div>In case the rule is already there. check the host firewall rules using<br></div>iptables -t nat -L<br></div>iptables -t mangle -L<br>iptables -t filter -L<br><br></div>None of the tables should have any rule.<br></div>
<div><div>
<div class="gmail_extra">
<br><div class="gmail_quote">On Fri, Sep 19, 2014 at 9:41 AM, Srinivasreddy R <span dir="ltr"><<a href="mailto:srinivasreddy4390@gmail.com" target="_blank">srinivasreddy4390@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">hi, <div>i have checked security group rules . </div>
<div>my instance is pinging to router and even a device in external network .</div>
<div>mostly my problem may in host's firewall .</div>
<div>
<div>how can i identify which rule is dropping the ssh traffic .?</div>
<div>how can i confirm that ssh traffic is blocked at firewall .?</div>
<div>i there any way to see the firewall dropped packets ?</div>
</div>
<div><br></div>
<div>thanks ,</div>
<div>srinivas.</div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
</div>
<div><div>
<div class="gmail_extra">
<br><div class="gmail_quote">On Thu, Sep 18, 2014 at 7:36 PM, Akilesh K <span dir="ltr"><<a href="mailto:akilesh1597@gmail.com" target="_blank">akilesh1597@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">I believe you have checked the security group rules. Make sure the instance is able to ping the router. If yes the problem lies in your host's firewall rules. Flush the hosts iptable rules(you may take a backup before you do that). <br></div>
<div><div>
<div class="gmail_extra">
<br><div class="gmail_quote">On Thu, Sep 18, 2014 at 7:32 PM, Srinivasreddy R <span dir="ltr"><<a href="mailto:srinivasreddy4390@gmail.com" target="_blank">srinivasreddy4390@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div class="gmail_quote">
<div>
<div>
<div>
<div></div>hi ,<br></div>thanks for your reply .<br><br></div>
<div>1. i have checked ssh server is running in instance ..<br></div>
<div> ssh from one instance to another is possible using private network[demo-net] .<br></div>
<div>2. checked ssh is running in port 22<br></div>
<div>3. telnet <ip> 22 is not working .<br><br><br></div>
<div>4. output when i run ssh using verbose pasted at <br><br><a href="http://paste.openstack.org/show/112860/" target="_blank">http://paste.openstack.org/show/112860/</a><br><br><br></div> <br><br>==================================<br></div>
<div>ip tables output <br><br></div>
<div>my internal network for vm is 11.0.0.x and external network is 172.0.0.x <br><br></div>
<div>
<br>root@user-ThinkCentre-M73:/home/user# ip netns exec qrouter-f6e00f94-1c6d-4cf5-8cae-319e393240fe iptables -t nat -S<br>-P PREROUTING ACCEPT<br>-P INPUT ACCEPT<br>-P OUTPUT ACCEPT<br>-P POSTROUTING ACCEPT<br>-N neutron-l3-agent-OUTPUT<br>-N neutron-l3-agent-POSTROUTING<br>-N neutron-l3-agent-PREROUTING<br>-N neutron-l3-agent-float-snat<br>-N neutron-l3-agent-snat<br>-N neutron-postrouting-bottom<br>-A PREROUTING -j neutron-l3-agent-PREROUTING<br>-A OUTPUT -j neutron-l3-agent-OUTPUT<br>-A POSTROUTING -j neutron-l3-agent-POSTROUTING<br>-A POSTROUTING -j neutron-postrouting-bottom<br>-A neutron-l3-agent-OUTPUT -d <a href="http://172.0.0.7/32" target="_blank">172.0.0.7/32</a> -j DNAT --to-destination 11.0.0.9<br>-A neutron-l3-agent-OUTPUT -d <a href="http://172.0.0.3/32" target="_blank">172.0.0.3/32</a> -j DNAT --to-destination 11.0.0.2<br>-A neutron-l3-agent-OUTPUT -d <a href="http://172.0.0.4/32" target="_blank">172.0.0.4/32</a> -j DNAT --to-destination 11.0.0.5<br>-A neutron-l3-agent-POSTROUTING ! -i qg-ec80d9fb-82 ! -o qg-ec80d9fb-82 -m conntrack ! --ctstate DNAT -j ACCEPT<br>-A neutron-l3-agent-PREROUTING -d <a href="http://169.254.169.254/32" target="_blank">169.254.169.254/32</a> -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697<br>-A neutron-l3-agent-PREROUTING -d <a href="http://172.0.0.7/32" target="_blank">172.0.0.7/32</a> -j DNAT --to-destination 11.0.0.9<br>-A neutron-l3-agent-PREROUTING -d <a href="http://172.0.0.3/32" target="_blank">172.0.0.3/32</a> -j DNAT --to-destination 11.0.0.2<br>-A neutron-l3-agent-PREROUTING -d <a href="http://172.0.0.4/32" target="_blank">172.0.0.4/32</a> -j DNAT --to-destination 11.0.0.5<br>-A neutron-l3-agent-float-snat -s <a href="http://11.0.0.9/32" target="_blank">11.0.0.9/32</a> -j SNAT --to-source 172.0.0.7<br>-A neutron-l3-agent-float-snat -s <a href="http://11.0.0.2/32" target="_blank">11.0.0.2/32</a> -j SNAT --to-source 172.0.0.3<br>-A neutron-l3-agent-float-snat -s <a href="http://11.0.0.5/32" target="_blank">11.0.0.5/32</a> -j SNAT --to-source 172.0.0.4<br>-A neutron-l3-agent-snat -j neutron-l3-agent-float-snat<br>-A neutron-l3-agent-snat -s <a href="http://11.0.0.0/24" target="_blank">11.0.0.0/24</a> -j SNAT --to-source 172.0.0.2<br>-A neutron-postrouting-bottom -j neutron-l3-agent-snat<br><br><br><br><br>=====================<br></div>
<div>i pasted my dump flows of br-tun at <br><a href="http://paste.openstack.org/show/112859/" target="_blank">http://paste.openstack.org/show/112859/</a><br></div>
<div>
<br><br><br></div>
<div>as per the doc<br> <a href="https://openstack.redhat.com/Networking_in_too_much_detail" target="_blank">https://openstack.redhat.com/Networking_in_too_much_detail</a><br></div>
<div><br></div>
<div>br-ex is connected to router , router is connected to br-int , br-int is connected to bt-tun .<br><br></div>
<div>i have captured at br-int . my ssh request is reaching to br-int but not going through tunnel .<br><br></div>
<span><div>please help me .<br><br></div>
<div>
<br><br><br></div>thanks,<br>srinivas.<br><br></span><div><div><div><div><div><div>
<br><br><div class="gmail_extra">
<br><div class="gmail_quote">On Wed, Sep 17, 2014 at 9:30 PM, Sajith Kariyawasam <span dir="ltr"><<a href="mailto:sajhak@gmail.com" target="_blank">sajhak@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Hi,<div><br></div>
<div>Could be due to,</div>
<div> ssh server is not up and running in your instance,</div>
<div> or running in a different port rather than port 22,</div>
<div> or, ssh port access is restricted in openstack key pair configuration</div>
<div><br></div>
<div>You could also try telnet to check the connectivity, </div>
<div>$ telnet <ip> 22</div>
<div><br></div>
<div>Thanks,</div>
<div>Sajith</div>
<div> </div>
</div>
<div class="gmail_extra">
<br><div class="gmail_quote">
<div><div>On Wed, Sep 17, 2014 at 8:59 PM, Zoltán Lajos Kis <span dir="ltr"><<a href="mailto:zoltan.lajos.kis@ericsson.com" target="_blank">zoltan.lajos.kis@ericsson.com</a>></span> wrote:<br></div></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div><div>
<div lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Hi,</span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">What’s the output of running ssh with the verbose (-v) flag?</span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"> </span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">BR,</span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Zoltan</span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"> </span></p>
<div style="border-width:medium medium medium 1.5pt;border-style:none none none solid;border-color:-moz-use-text-color -moz-use-text-color -moz-use-text-color blue;padding:0in 0in 0in 4pt">
<div>
<div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(181,196,223) -moz-use-text-color -moz-use-text-color;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10pt;font-family:"Tahoma","sans-serif""> Srinivasreddy R [mailto:<a href="mailto:srinivasreddy4390@gmail.com" target="_blank">srinivasreddy4390@gmail.com</a>]
<br><b>Sent:</b> Wednesday, September 17, 2014 5:16 PM<br><b>To:</b> <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br><b>Subject:</b> [Openstack] able to ping but not able to ssh to instance</span></p>
</div>
</div>
<div><div>
<p class="MsoNormal"> </p>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">hi,</p>
</div>
<p class="MsoNormal">i am able to ping my instance form external network . </p>
</div>
<p class="MsoNormal">but not able to ssh to the instance . </p>
</div>
<p class="MsoNormal">i am using floating ip s for ping,ssh.</p>
</div>
<p class="MsoNormal" style="margin-bottom:12pt">please help me .<br><br>
thanks,<br>
srinivas.</p>
</div>
</div></div>
</div>
</div>
</div>
<br></div></div>
<span>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br><br></span>
</blockquote>
</div>
<span><font color="#888888"><br><br clear="all"><div><br></div>-- <br>Best Regards<div>Sajith</div>
</font></span>
</div>
</blockquote>
</div>
<br></div>
</div></div></div></div></div></div>
</div></div>
<br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br><br></blockquote>
</div>
<br></div>
</div></div>
</blockquote>
</div>
<br></div>
</div></div>
</blockquote>
</div>
<br></div>
</div></div>
</blockquote>
</div>
<br></div>
</div></blockquote></div><br></div></div></blockquote></div><br></div></div>