Re: [Rdo-list] Bug for multinode deploy with packstack

Hi Lars Thanks for confirm the bug. the other module have same bug, like cinder.heat, glance 172.18.1.12 controller 172.18.1.13 network 172.18.1.14 compute 172.18.1.15 compute 172.18.1.16 cinder storage 172.18.1.17 heat 172.18.1.18 glance The system "network" runs neutron-server and neutron-*-agent; the system "controller" runs everything other than nova-compute glance and cinder, including Horizon. I use the newest packstack for test # rpm -qa | grep packstack openstack-packstack-2013.2.1-0.32.dev987.el6.noarch After packstack finishes, the iptables rules on "cinder" look like this: # iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -s 172.18.1.14/32 -p tcp -m multiport --dports 3260,8776 -m comment --comment "001 cinder incoming 172.18.1.14" -j ACCEPT -A INPUT -s 172.18.1.15/32 -p tcp -m multiport --dports 3260,8776 -m comment --comment "001 cinder incoming 172.18.1.15" -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited the iptables also have no rule let horizon access the cinder. the iptables rules on "heat" look like this: # iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited no any iptables rules. so in horizon ,can not access heat. the iptables rules on "glance" look like this: # iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -s 172.18.1.14/32 -p tcp -m multiport --dports 9292 -m comment --comment "001 glance incoming 172.18.1.14" -j ACCEPT -A INPUT -s 172.18.1.15/32 -p tcp -m multiport --dports 9292 -m comment --comment "001 glance incoming 172.18.1.15" -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited also have same problem.the iptables also have no rule let horizon access the glance.. On Thu, Mar 6, 2014 at 6:57 AM, Lars Kellogg-Stedman <lars(a)redhat.com&gt;wrote: -- Shake Chen