neutron

Why packets from instance cannot make into linux bridge when configure a different IP

Asked by Yi Liu

I have done a experiment as below:

1) Create a network and make it DHCP disabled

2) Launch an instance in this network, then check its network port by 'neutron port-list', get the its info as below:
| id | name | mac_address | fixed_ips |
| 9dc008e0-4d98-45d7-a24f-fd5f2a7866c0 | | fa:16:3e:19:3a:2f | {"subnet_id": "6a1917b8-5fea-45ec-9937-237198cad697", "ip_address": "169.254.0.2"} |

3) Log in the instance, and configure its IP as "169.254.0.2", then PING "169.254.0.1", succeeded

4) Change its IP as "169.254.0.3", then PING "169.254.0.1", failed

     When configure IP as "169.254.0.3 and PING "169.254.0.1", I tried to tcpdump -i tap9dc008e0-4d -n, I get the arp packet from instance:
     14:09:44.772154 ARP, Request who-has 169.254.0.1 tell 169.254.0.3, length 28

     However, then I try "tcpdump -i qbr9dc008e0-4d -n", didn't get the arp packets.

     It is clearly that the packets from instance didn't make into linux bridge...

So, my question is why?
Is the iptables filter the packets from instance when the source IP(169.254.0.3) is not the IP(169.254.0.2) that OpenStack assigned?

If yes, is there any way to configure to allow instance to use any available IP of the network, not just the one which OpenStack assigned?

Question information

Language:
English Edit question
Status:
Answered
For:
neutron Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Yi Liu (ryan-yi-liu) said : 		#1

I tried to stop iptables service, the issue still exists.

Revision history for this message
yong sheng gong (gongysh) said : 		#2

1. disable the security group
[securitygroup]
# sample firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
# Firewall driver for realizing neutron security group function.
# firewall_driver = neutron.agent.firewall.NoopFirewallDriver
or 2.
update port's allowed_address_pairs attr:
neutron port-update portid --allowed_address_pairs xxx

Can you help with this problem?

Provide an answer of your own, or ask Yi Liu for more information if necessary.

To post a message you must log in.