<p>Hi,</p>
<p>ICMP is working at layer 3, and is one of the IP associated protocols. So IP-table, is the right filtering technology, ebtables is mainly for the link layer.</p>
<p>Could you confirm that there is no other program setting fw rules? Also could you check a ping from other host (a vm in other host or from other physical host)?</p>
<p>Regarding iptables rules backup, it can easily included in the hook. However, these rules are VM specific and it wouldn't make sense to restore the rules and not the associated VMs upon a host restart.</p>
<p>Cheers and thanks for the feedback</p>
<p>Ruben</p>
<div class="gmail_quote">On Aug 2, 2011 1:36 PM, "Christoph Raible" <<a href="mailto:c.raible@science-computing.de" target="_blank">c.raible@science-computing.de</a>> wrote:<br type="attribution">> Hi,<br>
> <br>> now I tried with two VMs on the same host, but I can ping from VM to VM <br>
> ... This looks like the Hook doesn't work.<br>> <br>> I also have a talk to some IPTABLE experts they think that this isn't <br>> working because the ICMP "drop" is based on Network Layer 3 and IPTABLES <br>
> is working on Layer 2...<br>> <br>> They said that it will make sense when it is integrated into EBTABLES <br>> but not in IPTABLES.<br>> <br>> <br>> Next issue on this is, when I restart the Cluster-Node / Host-Node or <br>
> IPTABLES-Service all rules are "deleted" this is very ugly...<br>> <br>> There should be a mechanism to integrate those rules by starting one <br>> (maybe out from database) or something else!<br>
> <br>
> Hope you understand what I mean ;)<br>> <br>> <br>> Regards,<br>> Christoph<br>> <br>> <br>> <br>> Am 01.08.2011 17:33, schrieb Jaime Melis:<br>>> Hi Christoph,<br>>><br>>> regarding the firewall hook, I've reviewed the rules and simulated your<br>
>> scenario and it's the expected behaviour. The ping should work from the<br>>> worker node running the vm to the vm, but it won't from other vms, which<br>>> is the purpose of the filter. Could you please start another VM and try<br>
>> pinging from there?<br>>><br>>> Regards,<br>>> Jaime<br>>><br>>> 2011/7/29 Christoph Raible <<a href="mailto:c.raible@science-computing.de" target="_blank">c.raible@science-computing.de</a><br>
>> <mailto:<a href="mailto:c.raible@science-computing.de" target="_blank">c.raible@science-computing.de</a>>><br>
>><br>>> Hi Carlos,<br>>><br>>> this doesn't work for me... I uncomment this options and restart the<br>>> one daemon.<br>>><br>>> Then I create a virtual Machine with following Template:<br>
>><br>>> <a href="https://pastee.org/j6f3d" target="_blank">https://pastee.org/j6f3d</a><br>>><br>>> After commenting out Default requiretty in /etc/sudoers<br>>> creation and inserting IPTABLES rule works but have no effect...<br>
>><br>>> An IPTABLES -L shows me the following output:<br>>><br>>> <a href="https://pastee.org/vjynr" target="_blank">https://pastee.org/vjynr</a><br>>><br>>> But I can Ping my VM... Is it possible that the Firwalling is still<br>
>> buggy? Or is this an error of my bridged network configuration?<br>>><br>>> Regards<br>>><br>>> Chritoph<br>>><br>>><br>>><br>>><br>>><br>>> Am <a href="tel:27.07.2011%2017" value="+12707201117" target="_blank">27.07.2011 17</a> <tel:27.07.2011%2017>:16, schrieb Carlos Martín<br>
>> Sánchez:<br>>><br>>> Hi Christoph,<br>>><br>>> We are aware of the top command bug, see [1] if you are<br>>> interested in<br>>> the ticket.<br>
>><br>>> As for the iptables configuration, we are still improving the<br>>> documentation and some requirements and configurations are not as<br>>> detailed as they should.<br>
>><br>>> Some of the networking features have to be activated editing<br>>> /etc/one/oned.conf<br>>> I believe you just need to uncomment this hook:<br>>><br>>> VM_HOOK = [<br>
>> name = "firewall",<br>>> on = "RUNNING",<br>>> command = "vnm/firewall",<br>>> arguments = "on $TEMPLATE",<br>
>> remote = "yes" ]<br>>><br>>> And restart OpenNebula with one stop; one start<br>>><br>>> Best regards,<br>>> Carlos.<br>>><br>
>> [1] <a href="http://dev.opennebula.org/__issues/747" target="_blank">http://dev.opennebula.org/__issues/747</a><br>>> <<a href="http://dev.opennebula.org/issues/747" target="_blank">http://dev.opennebula.org/issues/747</a>><br>
>> --<br>>> Carlos Martín, MSc<br>>> Project Major Contributor<br>>> OpenNebula - The Open Source Toolkit for Cloud Computing<br>>> <a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> <<a href="http://www.OpenNebula.org" target="_blank">http://www.OpenNebula.org</a>><br>
>> <<a href="http://www.opennebula.org/" target="_blank">http://www.opennebula.org/</a>> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a><br>>> <mailto:<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a>><br>
>> <mailto:<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> <mailto:<a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a>>__><br>>><br>
>><br>>><br>
>> On Wed, Jul 27, 2011 at 2:00 PM, Christoph Raible<br>>> <<a href="mailto:c.raible@science-computing.de" target="_blank">c.raible@science-computing.de</a><br>>> <mailto:<a href="mailto:c.raible@science-computing.de" target="_blank">c.raible@science-computing.de</a>><br>
>> <mailto:<a href="mailto:c.raible@science-__computing.de" target="_blank">c.raible@science-__computing.de</a><br>>> <mailto:<a href="mailto:c.raible@science-computing.de" target="_blank">c.raible@science-computing.de</a>>>><br>
>> wrote:<br>>><br>>> Am <a href="tel:27.07.2011%2011" value="+12707201111" target="_blank">27.07.2011 11</a> <tel:27.07.2011%2011><br>>> <tel:27.07.2011%2011>:14, schrieb Héctor Sanjuán:<br>
>><br>>><br>>> Hi Christoph,<br>
>><br>>> it seems the ruby gem 'sequel' is not present in your<br>>> system.<br>>> This gem<br>>> is needed by the monitoring system (requirements in [1],<br>
>> also<br>>> seems you<br>>> are missing sqlite3), which is used by Sunstone<br>>> (requirements in<br>>> [2]).<br>>><br>
>> You can install the missing dependencies manually<br>>> issuing 'gem<br>>> install...'.<br>>><br>>> Also, in order to assure that you have all the dependencies<br>
>> necessary<br>>> for OpenNebula in general, we recommend to use the<br>>> 'install_gems' script<br>>> [3], which will try to install all the ruby gems for you<br>
>> in their<br>>> correct versions.<br>>><br>>> For Scientific linux, this means however that you will<br>>> need to<br>>> install<br>
>> the packages listed in the doc manually before the<br>>> script can<br>>> proceed to<br>>> install the gems.<br>>><br>>> Don't hesitate to write back if you have more questions,<br>
>><br>>> Hector<br>>><br>>> [1]<br>>> <a href="http://opennebula.org/____documentation:rel3.0:acctd_____conf#requirements_installation" target="_blank">http://opennebula.org/____documentation:rel3.0:acctd_____conf#requirements_installation</a><br>
>> <<a href="http://opennebula.org/__documentation:rel3.0:acctd___conf#requirements_installation" target="_blank">http://opennebula.org/__documentation:rel3.0:acctd___conf#requirements_installation</a>><br>
>> <<a href="http://opennebula.org/__documentation:rel3.0:acctd___conf#requirements_installation" target="_blank">http://opennebula.org/__documentation:rel3.0:acctd___conf#requirements_installation</a><br>
>> <<a href="http://opennebula.org/documentation:rel3.0:acctd_conf#requirements_installation" target="_blank">http://opennebula.org/documentation:rel3.0:acctd_conf#requirements_installation</a>>__><br>
>><br>>> [2]<br>
>> <a href="http://opennebula.org/____documentation:rel3.0:sunstone#____requirements_installation" target="_blank">http://opennebula.org/____documentation:rel3.0:sunstone#____requirements_installation</a><br>
>> <<a href="http://opennebula.org/__documentation:rel3.0:sunstone#__requirements_installation" target="_blank">http://opennebula.org/__documentation:rel3.0:sunstone#__requirements_installation</a>><br>
>> <<a href="http://opennebula.org/__documentation:rel3.0:sunstone#__requirements_installation" target="_blank">http://opennebula.org/__documentation:rel3.0:sunstone#__requirements_installation</a><br>>> <<a href="http://opennebula.org/documentation:rel3.0:sunstone#requirements_installation" target="_blank">http://opennebula.org/documentation:rel3.0:sunstone#requirements_installation</a>>><br>
>><br>>> [3]<br>>> <a href="http://opennebula.org/____documentation:rel3.0:ignc#____ruby_libraries_requirements_____front-end" target="_blank">http://opennebula.org/____documentation:rel3.0:ignc#____ruby_libraries_requirements_____front-end</a><br>
>> <<a href="http://opennebula.org/__documentation:rel3.0:ignc#__ruby_libraries_requirements___front-end" target="_blank">http://opennebula.org/__documentation:rel3.0:ignc#__ruby_libraries_requirements___front-end</a>><br>
>> <<a href="http://opennebula.org/__documentation:rel3.0:ignc#__ruby_libraries_requirements___front-end" target="_blank">http://opennebula.org/__documentation:rel3.0:ignc#__ruby_libraries_requirements___front-end</a><br>
>> <<a href="http://opennebula.org/documentation:rel3.0:ignc#ruby_libraries_requirements_front-end" target="_blank">http://opennebula.org/documentation:rel3.0:ignc#ruby_libraries_requirements_front-end</a>>><br>
>><br>
>><br>>><br>>><br>>><br>>> El 27/07/11 10:21, Christoph Raible escribió:<br>>><br>>> Hi @all,<br>>><br>>> I got the following error on Starting<br>
>> sunstone-server with<br>>> OpenNebula 3.0 Beta1.<br>>><br>>> <a href="http://pastebin.com/SdBJZSc5" target="_blank">http://pastebin.com/SdBJZSc5</a><br>>><br>
>><br>
>> My System is a 64-Bit Scientific Linux 6.0<br>>> Selinux disabled<br>>> iptables disabled<br>>> One networkinterface as bridge<br>
>><br>>><br>>> Following Gems are installed:<br>>> daemons (1.1.4)<br>>> eventmachine (0.12.10)<br>>> json (1.5.3)<br>
>> mkrf (0.2.3)<br>>> nokogiri (1.5.0)<br>>> rack (1.3.2)<br>>> rake (0.9.2, 0.8.7)<br>>> sinatra (1.2.6)<br>
>> thin (1.2.11)<br>>> tilt (1.3.2)<br>>><br>>> and my sunstone-server.conf is configured so:<br>>><br>>> <a href="http://pastebin.com/4bjn1bqX" target="_blank">http://pastebin.com/4bjn1bqX</a><br>
>><br>>><br>>> I hope someone can help me with my problem...<br>>> I need the Sunstone server for an article in the<br>>> linux-admin<br>>> magazin<br>
>> (Germany ;) )<br>>><br>>><br>>><br>>> Regards<br>>> Chr.Raible<br>>><br>>><br>>><br>>><br>>> Hi Thanks for your help.<br>
>><br>>> With those informations and all gems, sunstone and<br>>> monitoring systemHi<br>> now I tried with two VMs but i can also ping from VM to VM ...<br>> <br>> I also have a talk to some IPTABLES experts they think that this isn't <br>
> working because the ICMP package is on Network Layer 3 and IPTABLES is <br>> working on Layer 2... This would not be make sense...<br>> <br>>> works fine :)<br>>><br>>> Now I found two other "errors/bug" (don't know how to<br>
>> describe ;) )<br>>><br>>> The "onevm top" command doesn't refresh the status of the<br>>> VMs. When<br>>> I start creation of an VM and switch to the top overview,<br>
>> the status<br>>> is always on pending state...<br>>><br>>> The second bug is that the IP-Table configurtaion doesn't<br>>> work. I<br>>> insert the following Option to the NIC section:<br>
>><br>>> ICMP = drop<br>>><br>>> But after creation of the VM I can ping those VM.<br>>> oneadmin has rights to add an delete iptable rules and has<br>>> also full<br>
>> sudo rights...<br>>><br>>> Has anyone an idea? Or is this just not implemented in the Beta?<br>>><br>>> Thank an best regards,<br>>><br>>> Christoph<br>
>><br>>><br>>><br>>> --<br>>> Vorstand/Board of Management:<br>>> Dr. Bernd Finkbeiner, Dr. Roland Niemeier, Dr. Arno Steitz, Dr.<br>>> Ingrid Zech<br>
>> Vorsitzender des Aufsichtsrats/<br>>> Chairman of the Supervisory Board:<br>>> Philippe Miltin<br>>> Sitz/Registered Office: Tuebingen<br>>> Registergericht/Registration Court: Stuttgart<br>
>> Registernummer/Commercial Register No.: HRB 382196<br>>><br>>> ___________________________________________________<br>>> Users mailing list<br>>> <a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a> <mailto:<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a>><br>
>> <mailto:<a href="mailto:Users@lists." target="_blank">Users@lists.</a>__<a href="http://opennebula.org" target="_blank">opennebula.org</a><br>>> <mailto:<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a>>><br>
>><br>>> <a href="http://lists.opennebula.org/____listinfo.cgi/users-opennebula.____org" target="_blank">http://lists.opennebula.org/____listinfo.cgi/users-opennebula.____org</a><br>>> <<a href="http://lists.opennebula.org/__listinfo.cgi/users-opennebula.__org" target="_blank">http://lists.opennebula.org/__listinfo.cgi/users-opennebula.__org</a>><br>
>> <<a href="http://lists.opennebula.org/__listinfo.cgi/users-opennebula.__org" target="_blank">http://lists.opennebula.org/__listinfo.cgi/users-opennebula.__org</a><br>>> <<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a>>><br>
>><br>>><br>>><br>>> --<br>>> Vorstand/Board of Management:<br>>> Dr. Bernd Finkbeiner, Dr. Roland Niemeier, Dr. Arno Steitz, Dr.<br>>> Ingrid Zech<br>>> Vorsitzender des Aufsichtsrats/<br>
>> Chairman of the Supervisory Board:<br>>> Philippe Miltin<br>>> Sitz/Registered Office: Tuebingen<br>>> Registergericht/Registration Court: Stuttgart<br>>> Registernummer/Commercial Register No.: HRB 382196<br>
>><br>>> _________________________________________________<br>>> Users mailing list<br>>> <a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a> <mailto:<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a>><br>
>> <a href="http://lists.opennebula.org/__listinfo.cgi/users-opennebula.__org" target="_blank">http://lists.opennebula.org/__listinfo.cgi/users-opennebula.__org</a><br>>> <<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a>><br>
>><br>>><br>>><br>>><br>>> --<br>>> Jaime Melis, Cloud Technology Engineer/Researcher<br>>> Major Contributor<br>>> OpenNebula - The Open Source Toolkit for Cloud Computing<br>
>> <a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> <<a href="http://www.OpenNebula.org" target="_blank">http://www.OpenNebula.org</a>> | <a href="mailto:jmelis@opennebula.org" target="_blank">jmelis@opennebula.org</a><br>
>> <mailto:<a href="mailto:jmelis@opennebula.org" target="_blank">jmelis@opennebula.org</a>><br>
> <br>> -- <br>> Vorstand/Board of Management:<br>> Dr. Bernd Finkbeiner, Dr. Roland Niemeier, <br>> Dr. Arno Steitz, Dr. Ingrid Zech<br>> Vorsitzender des Aufsichtsrats/<br>> Chairman of the Supervisory Board:<br>
> Philippe Miltin<br>> Sitz/Registered Office: Tuebingen<br>> Registergericht/Registration Court: Stuttgart<br>> Registernummer/Commercial Register No.: HRB 382196 <br>> <br>> <br>> _______________________________________________<br>
> Users mailing list<br>> <a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
</div>