<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">A couple of things to check, <div class=""><br class=""></div><div class="">by default DVR is not enabled, therefore make sure that’s on. </div><div class=""><br class=""></div><div class="">if you have more than one hypervisor, then check where the instance is booted and see if there is a router there, which should have the floating ip address and iptables will have a map for the 1to1 SNAT - DNAT and DNAT to SNAT. </div><div class=""><br class=""></div><div class="">Ciao, </div><div class="">Remo <br class=""><div><blockquote type="cite" class=""><div class="">On Apr 15, 2016, at 09:41, Jorge Luiz Correa <<a href="mailto:correajl@gmail.com" class="">correajl@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I'm using the DVR network scenario described in <a href="http://docs.openstack.org/liberty/networking-guide/scenario-dvr-ovs.html" class="">http://docs.openstack.org/liberty/networking-guide/scenario-dvr-ovs.html</a>. My installation was based on Ubuntu Install guide. <br class=""><br class="">I've an external network, flat, with public IPs.<br class="">I've a project with a tenant network and subnet, one virtual router that connects this subnet to the external net. <br class=""><br class="">I've launched one VM connected to the tenant network (<a href="http://172.16.0.0/24" class="">172.16.0.0/24</a>). The IPs address are (ports on this subnet):<br class=""><br class="">172.16.0.1 - network:router_interface_distributed<br class="">172.16.0.2 - network:dhcp<br class="">172.16.0.5 - compute:nova <- this is the VM<br class=""><br class="">Then I associated a Floating IP of external network to this VM, lets say A.B.C.D (a public IP address).<br class=""><br class="">From an external network host I'm trying to ping A.B.C.D. It doesn't work. So, I follow the packet path inside the virtual interfaces and bridges, as shown in attached image. <br class=""><br class="">On iptables of compute host where this VM is running we can see (summarized):<br class=""><br class="">FORWARD -> neutron-openvswi-FORWARD -> neutron-openvswi-sg-chain -> neutron-openvswi-i7a7a669c-3 -> neutron-openvswi-sg-fallback -> DROP<br class=""><br class="">iptables -L -Z -n -v<br class=""><br class="">iptables -L -n -v<br class=""><br class="">Chain <b class="">FORWARD</b> (policy ACCEPT 0 packets, 0 bytes)<br class=""> pkts bytes target prot opt in out source destination <br class=""> 24 2016 neutron-openvswi-FORWARD all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <br class=""><br class="">Chain <b class="">neutron-openvswi-FORWARD</b> (1 references)<br class=""> pkts bytes target prot opt in out source destination <br class=""> 24 2016 neutron-openvswi-sg-chain all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> PHYSDEV match --physdev-out tap7a7a669c-3f --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */<br class=""> 0 0 neutron-openvswi-sg-chain all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> PHYSDEV match --physdev-in tap7a7a669c-3f --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */<br class=""><br class="">Chain <b class="">neutron-openvswi-sg-chain </b>(2 references)<br class=""> pkts bytes target prot opt in out source destination <br class=""> 24 2016 neutron-openvswi-i7a7a669c-3 all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> PHYSDEV match --physdev-out tap7a7a669c-3f --physdev-is-bridged /* Jump to the VM specific chain. */<br class=""> 0 0 neutron-openvswi-o7a7a669c-3 all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> PHYSDEV match --physdev-in tap7a7a669c-3f --physdev-is-bridged /* Jump to the VM specific chain. */<br class=""> 0 0 ACCEPT all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <br class=""><br class="">Chain <b class="">neutron-openvswi-i7a7a669c-3</b> (1 references)<br class=""> pkts bytes target prot opt in out source destination <br class=""> 0 0 RETURN all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */<br class=""> 0 0 RETURN udp -- * * 172.16.0.2 <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> udp spt:67 udp dpt:68<br class=""> 0 0 RETURN all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> match-set NIPv43c228055-2735-4339-b9a8- src<br class=""> 0 0 DROP all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */<br class=""> 24 2016 <span style="color:rgb(255,0,0)" class=""><b class="">neutron-openvswi-sg-fallback</b></span> all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> /* Send unmatched traffic to the fallback chain. */<br class=""><br class="">Chain<b class=""><span style="color:rgb(255,0,0)" class=""> neutron-openvswi-sg-fallback</span></b> (2 references)<br class=""> pkts bytes target prot opt in out source destination <br class=""> 24 2016 <b class=""><span style="color:rgb(255,0,0)" class="">DROP</span></b> all -- * * <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> /* Default drop rule for unmatched traffic. */<br class=""> <br class=""><br class="">I think that in neutron-openvswi-i7a7a669c-3 should exist some RETURN rule using the 172.16.0.5 IP address. <br class=""><br class="">Some idea? Is this really a problem (bug?) or am I doing something wrong?<br class=""><br class="">Thanks for any help!<br class=""><br clear="all" class=""><div class=""><div class="gmail_signature"><div dir="ltr" class="">- JLC</div></div></div>
</div>
!DSPAM:1,5710f455154911543464705!
<span id="cid:D80E13C4-B4BA-4A09-B744-BBAB0CFBB1E1"><dvr_floatingips_debug.png></span>_______________________________________________<br class="">Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" class="">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br class="">Post to : <a href="mailto:openstack@lists.openstack.org" class="">openstack@lists.openstack.org</a><br class="">Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" class="">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br class=""><br class=""><br class="">!DSPAM:1,5710f455154911543464705!<br class=""></div></blockquote></div><br class=""></div></body></html>