Hello Sean,<div><br></div><div>ok, I think we understand what you mean.</div><div><br></div><div>There are two things here: (1) Getting the host to forward the port with iptables (2) doing it automatically with OpenNebula using customized network drivers:</div>
<div><br></div><div>Let's start by achieving this manually and we can move on later on to doing it automatically with OpenNebula:</div><div><br></div><div>To do this you need to do the following in the host that's running the gateway VM:</div>
<div><br></div><div>* add an iptables rule to forward to the desired vm:</div><div><font face="'courier new', monospace">iptables -t nat -I PREROUTING -p tcp --dport <PORT> -j DNAT --to-destination <guest_vm_ip>:<PORT></font></div>
<div><br></div><div>* allow forwarding:</div><div><font face="'courier new', monospace">echo "1" > /proc/sys/net/ipv4/ip_forward</font></div><div><font face="'courier new', monospace">iptables -I FORWARD -m state -d <libvirt_nat_network>/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT</font></div>
<div><br></div><div>* add a static route:</div><div><font face="'courier new', monospace">route add -net <libvirt_nat_network> netmask 255.255.255.0 dev <BRIDGE></font></div><div><br></div><div>Can you try this and let us know if it works?</div>
<div><br>Cheers,<br>Jaime</div><div><br></div><div>On Fri, May 11, 2012 at 7:08 PM, Sean Abbott <span dir="ltr"><<a href="mailto:seabbott@akamai.com" target="_blank">seabbott@akamai.com</a>></span> wrote:</div><div>
<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The hosts connect to each other through a backend network. They're all<br>
on the same switch, and they use a bridge to that backend network to<br>
provide inter-vm connectivity.<br>
<br>
So, in the templates below, fullbackend is connected to a bridge that<br>
goes to a private network. natnet0 is connected to virbr0, which does<br>
IP masquerading out to the world via libvirt's default nat with<br>
libvirt's default iptables rules. As I said, all that's working fine.<br>
So regardless of whether opennebula truly SUPPORTS it, it does work. :-)<br>
<br>
All I need to go is get one port to forward to one vm and my setup will<br>
work wonderfully.<br>
<div class="HOEnZb"><div class="h5"><br>
On 05/11/2012 11:01 AM, Jaime Melis wrote:<br>
> Dear Sean,<br>
><br>
> OpenNebula does not support Libvirt's NAT-network(<a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a>).<br>
> You have to create a network environment as described here:<br>
> <a href="http://opennebula.org/documentation:rel3.4:plan#networking" target="_blank">http://opennebula.org/documentation:rel3.4:plan#networking</a><br>
><br>
> How are your hosts connected to each other?<br>
><br>
> Regards,<br>
> Jaime<br>
><br>
> On Fri, May 11, 2012 at 4:40 PM, Sean Abbott <<a href="mailto:seabbott@akamai.com">seabbott@akamai.com</a>> wrote:<br>
>> Hello,<br>
>><br>
>> I have a setup intended for selenium grid. I'll have a bunch of<br>
>> machines using the default NAT for internet access and a management<br>
>> network for communication between each other. The template for these<br>
>> VMs is:<br>
>><br>
>> NIC=[<br>
>> MODEL=virtio,<br>
>> NETWORK="natnet0",<br>
>> NETWORK_UNAME=oneadmin ]<br>
>> NIC=[<br>
>> MODEL=virtio,<br>
>> NETWORK="fullbackend",<br>
>> NETWORK_UNAME=oneadmin ]<br>
>><br>
>><br>
>> That's all working. I need one VM to be able to communicate with the<br>
>> outside world on a single port (4444). I've set up template as follows:<br>
>><br>
>> NIC=[<br>
>> MODEL=virtio,<br>
>> NETWORK="natnet0",<br>
>> NETWORK_UNAME=oneadmin,<br>
>> IP=192.168.122.100,<br>
>> WHITE_PORTS_TCP=4444 ]<br>
>> NIC=[<br>
>> MODEL=virtio,<br>
>> NETWORK="fullbackend",<br>
>> NETWORK_UNAME=oneadmin ]<br>
>><br>
>> The resulting VM can still use the internet and it can still communicate<br>
>> with the other VMs. I can communicate with it on port 4444 from the<br>
>> host that it's on, but not from outside.<br>
>><br>
>> Is this what WHITE_PORTS_TCP is intended for? Am I doing something wrong?<br>
>><br>
>> Thanks!<br>
>><br>
>> sean<br>
>> _______________________________________________<br>
>> Users mailing list<br>
>> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
><br>
><br>
<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Jaime Melis<br>Project Engineer<br>OpenNebula - The Open Source Toolkit for Cloud Computing<br><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:jmelis@opennebula.org" target="_blank">jmelis@opennebula.org</a><br>
</div>