Open Stack

Yes..
I have controller + network + compute node in a single machine.

--
Trinath Somanchi - B39208
trinath.somanchi at freescale.com | extn: 4048

From: 郭龙仓 [mailto:guolongcang.work at gmail.com]
Sent: Wednesday, December 11, 2013 2:08 PM
To: Somanchi Trinath-B39208
Cc: openstack at lists.openstack.org
Subject: Re: [Openstack] [FWaaS] Doubts with FWaaS

all-in-one deploy ?  qr-{xxx} device is created on the network node .

2013/12/11 trinath.somanchi at freescale.com<mailto:trinath.somanchi at freescale.com> <trinath.somanchi at freescale.com<mailto:trinath.somanchi at freescale.com>>
Hi-

I have the following chains in the iptables.

root at havana:~# iptables -L -n -v
Chain INPUT (policy ACCEPT 6021 packets, 474K bytes)
pkts bytes target     prot opt in     out     source               destination
 5921  465K nova-api-INPUT  all  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>            tcp dpt:67

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
    0     0 nova-filter-top  all  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>
    0     0 nova-api-FORWARD  all  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>
    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0<http://0.0.0.0/0>            192.168.122.0/24<http://192.168.122.0/24>     ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24<http://192.168.122.0/24>     0.0.0.0/0<http://0.0.0.0/0>
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 6746 packets, 462K bytes)
pkts bytes target     prot opt in     out     source               destination
 6614  452K nova-filter-top  all  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>
 6614  452K nova-api-OUTPUT  all  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>

Chain nova-api-FORWARD (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain nova-api-INPUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            10.10.10.100         tcp dpt:8775

Chain nova-api-OUTPUT (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain nova-api-local (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain nova-filter-top (2 references)
pkts bytes target     prot opt in     out     source               destination
 6614  452K nova-api-local  all  --  *      *       0.0.0.0/0<http://0.0.0.0/0>            0.0.0.0/0<http://0.0.0.0/0>


I find none with the names suggested below. Am I missing any of the configurations required.

Kindly help me in this regard.

--
Trinath Somanchi - B39208
trinath.somanchi at freescale.com<mailto:trinath.somanchi at freescale.com> | extn: 4048

From: 郭龙仓 [mailto:guolongcang.work at gmail.com<mailto:guolongcang.work at gmail.com>]
Sent: Wednesday, December 11, 2013 1:46 PM
To: Somanchi Trinath-B39208
Cc: openstack at lists.openstack.org<mailto:openstack at lists.openstack.org>
Subject: Re: [Openstack] [FWaaS] Doubts with FWaaS

FWaaS is implemented through iptables on qr-{xxx} device , one inbound chain named like neutron-l3-agent-iv{xxx} and one outbound chain named like  neutron-l3-agent-ov{xxx}  .

You can check the qr-{xxx} device's iptables rules.

2013/12/11 trinath.somanchi at freescale.com<mailto:trinath.somanchi at freescale.com> <trinath.somanchi at freescale.com<mailto:trinath.somanchi at freescale.com>>
Hi stackers-

I have configured FWaas with Neutron.

Also, I have created a simple firewall rule, added the same to a policy and created a firewall with this policy from CLI

The firewall is in ERROR state.

The rules and the policies were added to the DB.

How do I debug to find the error. Also, will these rules be added to the iptables?

Help be troubleshoot and understand the same.

--
Trinath Somanchi - B39208
trinath.somanchi at freescale.com<mailto:trinath.somanchi at freescale.com> | extn: 4048


_______________________________________________
Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to     : openstack at lists.openstack.org<mailto:openstack at lists.openstack.org>
Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack/attachments/20131211/52400a15/attachment.html>