What is the purpose of dmz_cidr?

Asked by David Kranz on 2012-01-25

Looking at the source, all it does is add an iptable rule like

-A nova-network-POSTROUTING -s 10.0.0.0/24 -d 172.18.0.131/32 -j ACCEPT

I am not fluent in iptable and could not find anything about this with a web search. Is there an easy
explanation of when and why you would want to set this flag?

Question information

Language:
English Edit question
Status:
Answered
For:
OpenStack Compute (nova) Edit question
Assignee:
No assignee Edit question
Last query:
2012-01-25
Last reply:
2012-01-25
Vish Ishaya (vishvananda) said : #1

Outgoing traffic from the vms is SNATTED to the ip of the network host (old mode) or the compute host (HA Networking --multi_host mode). This is to allow for them to communicate with the rest of the internet. It may be that there are some services that the hosts need to communicate with that are on an internal network where you want the source ip to remain the private ip of the host. The accept rule stops the normal SNAT. The most common use case is to allow the metadata api to use the private ip to look up data for the instance, so generally you can just set it to the /32 of your metadata server if you have just one. It is a cidr in case there are multiple services that you want to keep using the internal private ips.

On Jan 25, 2012, at 10:20 AM, David Kranz wrote:

> New question #185826 on OpenStack Compute (nova):
> https://answers.launchpad.net/nova/+question/185826
>
> Looking at the source, all it does is add an iptable rule like
>
> -A nova-network-POSTROUTING -s 10.0.0.0/24 -d 172.18.0.131/32 -j ACCEPT
>
>
> I am not fluent in iptable and could not find anything about this with a web search. Is there an easy
> explanation of when and why you would want to set this flag?
>
> --
> You received this question notification because you are a member of Nova
> Core, which is an answer contact for OpenStack Compute (nova).

Can you help with this problem?

Provide an answer of your own, or ask David Kranz for more information if necessary.

To post a message you must log in.