[Rdo-list] Question about Neutron Security Groups

[Daniel Speichert]

Answering my own question: I found out why rules were not working. There 
were no "firewall bridges" on compute nodes to which the rules would apply.

The reason for it was that compute nodes in nova.conf used the new:
libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtGenericVIFDriver

instead of the old and deprecated:
libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver

The latter one was used by my old cloud and therefore everything was 
working.

The fixed for me right now is to use the deprecated driver which forces 
creation of "firewall bridges". However, as I understand, the 
GenericVIFDriver should create the bridge if an appropriate meta 
information exists. This information should exists if security groups 
are used but it is not happening.
Is there any extra configuration required to make GenericVIFDriver 
create bridges? I am sure it is possible as the other drivers are 
removed in Icehouse.

Best Regards,
Daniel

On 3/5/2014 9:59 AM, Daniel Speichert wrote:
> Hello,
>
> I have a problem with Neutron security groups and I hoped you could 
> provide some ideas.
>
> I have two different cloud installation based on OpenStack Havana, 
> they both use Neutron setup with multiple tenants and routers.
>
> First cloud is based on Ubuntu and has both Neutron and Nova security 
> groups enabled (a mistake in configuraiton, I did not add 
> "firewall_driver=nova.virt.firewall.NoopFirewallDriver" to nova.conf. 
> On its compute nodes it has neutron-openvswitch-* iptables chains and 
> nova-instance* chains.
> Rules from all of these chains seem to get hits and security groups 
> work properly. This cloud uses GRE tunnels.
>
> Second cloud is based on CentOS 6.5 with RDO. It has the same Neutron 
> setup and nova security groups disabled and 
> "security_group_api=neutron". It does not have iptables chains 
> nova-instance* but neutron chains are properly applied. None of these 
> chains get any hits at all and all traffic to instances is allowed. 
> This cloud used VXLANs but I switched to GRE which did not help.
>
> On both clouds there are no additional iptables rules besides the ones 
> generated by OpenStack - I flushed all the rules and chains and forced 
> sync by adding a security group rule.
>
> Do you have any idea why security groups don't work, i.e. the chains 
> don't get traffic? It seems to me that the rules in chains 
> neutron-openvswi-FORWARD and neutron-openvswi-INPUT don't get any hits 
> at all on my second cloud installation.
> -- 
> Best Regards,
> Daniel
>
>
> _______________________________________________
> Rdo-list mailing list
> Rdo-list at redhat.com
> https://www.redhat.com/mailman/listinfo/rdo-list

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rdoproject.org/pipermail/dev/attachments/20140305/20871063/attachment.html>