Urgent : VMs can't access the external network

Asked by Anas ASO

My install is as follow :
  - two physical nodes, each with two NICs (one for management network, and the other for Data network (VMs) )
  - OpenStack Folsom
  - OS : CentOS 6.4
  - L2 plugin : Linuxbridge
  - namespaces=False
  - dhcp-agent is running on the controller node (all openstack services : nova, glance, cinder, quantum-server, ...)
  - l3-agent is runnig on the compute node
  - Floating IPs rang : 192.168.224.224 --> 192.168.224.2 ; cidr=192.168.224.0/24 ; gateway=192.168.224.254
  - Fixed IPs rang : 172.16.1.0/24

Output of my nat table :
----------------------------------------------------------------------------------------------------
[root@L3Agent ~]# iptables -t nat -nvL --line-numbers
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 quantum-l3-agent-PREROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
2 0 0 nova-compute-PREROUTING all -- * * 0.0.0.0/0 0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 9 556 quantum-l3-agent-POSTROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
2 0 0 nova-compute-POSTROUTING all -- * * 0.0.0.0/0 0.0.0.0/0
3 0 0 nova-postrouting-bottom all -- * * 0.0.0.0/0 0.0.0.0/0
4 0 0 quantum-postrouting-bottom all -- * * 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 9 packets, 556 bytes)
num pkts bytes target prot opt in out source destination
1 9 556 quantum-l3-agent-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
2 9 556 nova-compute-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0

Chain nova-compute-OUTPUT (1 references)
num pkts bytes target prot opt in out source destination

Chain nova-compute-POSTROUTING (1 references)
num pkts bytes target prot opt in out source destination

Chain nova-compute-PREROUTING (1 references)
num pkts bytes target prot opt in out source destination

Chain nova-compute-float-snat (1 references)
num pkts bytes target prot opt in out source destination

Chain nova-compute-snat (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 nova-compute-float-snat all -- * * 0.0.0.0/0 0.0.0.0/0

Chain nova-postrouting-bottom (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 nova-compute-snat all -- * * 0.0.0.0/0 0.0.0.0/0

Chain quantum-l3-agent-OUTPUT (1 references)
num pkts bytes target prot opt in out source destination

Chain quantum-l3-agent-POSTROUTING (1 references)
num pkts bytes target prot opt in out source destination
1 9 556 ACCEPT all -- !qg-3d0ac89c-d8 !qg-3d0ac89c-d8 0.0.0.0/0 0.0.0.0/0 ! ctstate DNAT

Chain quantum-l3-agent-PREROUTING (1 references)
num pkts bytes target prot opt in out source destination

Chain quantum-l3-agent-float-snat (1 references)
num pkts bytes target prot opt in out source destination

Chain quantum-l3-agent-snat (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 quantum-l3-agent-float-snat all -- * * 0.0.0.0/0 0.0.0.0/0
2 0 0 SNAT all -- * * 172.16.1.0/24 0.0.0.0/0 to:192.168.224.224

Chain quantum-postrouting-bottom (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 quantum-l3-agent-snat all -- * * 0.0.0.0/0 0.0.0.0/0
----------------------------------------------------------------------------------------------------
when I perform a ping from a VMs, no replay is received, because the outgoing packet is not SNATed (I used tcpdump on the destination machine)

any idea what's wrong?
if you need any additional information, you can ask.
thanks in advance

Question information

Language:
English Edit question
Status:
Solved
For:
neutron Edit question
Assignee:
No assignee Edit question
Solved by:
Anas ASO
Solved:
Last query:
Last reply:
Revision history for this message
Anas ASO (aso-anas) said :
#1

I got it work for while by deleting this entry in the nat table : Chain quantum-l3-agent-POSTROUTING

1 9 556 ACCEPT all -- !qg-3d0ac89c-d8 !qg-3d0ac89c-d8 0.0.0.0/0 0.0.0.0/0 ! ctstate DNAT

but the rules was added after some time. I guess Quantum restores its rules. So I have to change in the python files, but I don't know which one(s) is(are) responsible for this.

Can you help me please? I need to solve this problem as soon as possible

Revision history for this message
Lingxian Kong (kong) said :
#2

I met the same problem, and I think many people met the same thing too.

anybody here to help?

Revision history for this message
Anas ASO (aso-anas) said :
#3