<br><br><div class="gmail_quote">On Wed, Oct 10, 2012 at 7:25 PM, Ruben S. Montero <span dir="ltr"><<a href="mailto:rsmontero@opennebula.org" target="_blank">rsmontero@opennebula.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">> Let's assume a standard configuration with 2 networks: public and internal.<br>
> - Is possibile to configure multiple filtering types on the same cloud<br>
> and on the same virtual instance?<br>
> (ebtable for public, vlan/openvswitch for the internal)</div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<br>
</div>Virtual Network drivers are defined per host and not per network (in<br>
fact some of the technologies do not play together quite well, e.g.<br>
iptables and ovswitch, when used in the same host)<br>
<br>
You can however define different clusters with different network<br>
technology for the hosts, and then associated viertual networks to<br>
each cluster (public network to cluster public) Note that VMs will not<br>
be able to use both networks at the same time.<br></blockquote><div><br></div><div>Or you can use ovswitch and set the iptables rules using pre/clean/post scripts. I use this approach to load firewall rules based on the role the VM has in the network. It works. I unload the rules when the VM stops. The role is setup be subdomain in some cases and by a CONTEXT variables in others. Each role translates to a chain in iptables. </div>
<div><br></div><div>To keep the chains number to a minimum I insert a rule in the INPUT chain to direct traffic to VM IP to the `ROLE` chain. </div><div><br></div><div>The iptables are written in a file `role`.iptables and pre script add them. If you want to use this approach don't forget to properly set up sudo rules. clean script deletes them at VM shutdown.</div>
<div><br></div><div>I also use the above approach to sep up ebtables rules.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
In your specific case, I think you can simply not set the VLAN<br>
attribute in the public network template this will bypass the vlan<br>
processing in 802.1Q and ovswith drivers<br>
<div class="im"><br>
><br>
> I'm asking this because I would like to avoid a public vlan for each<br>
> customers on the public side (this will need a router reconfiguration<br>
> every time, to add the proper gateway on the same broadcast domain of<br>
> customer in each vlan)<br>
><br>
> - Is possibile, for a customer, to create a sort of PVLAN where a part<br>
> of its internal network will be isolated from other virtual machines<br>
> (same customer and same vlan). For example, let's assume that<br>
> customer1 has 5 VPS: vps1, vps2...vps5.<br>
> VPS1 should communicate only with VPS4 in a sort of custom vlan. I<br>
> have a VLAN, on private side, for each customers and I would like to<br>
> give customers the capability to create some communication groups.<br>
<br>
</div>I'd recommend to take a look to the virtual appliance router, simply<br>
add a virtual with a NIC in both networks<br>
<br>
<a href="http://opennebula.org/documentation:rel3.8:router" target="_blank">http://opennebula.org/documentation:rel3.8:router</a><br>
<div class="im HOEnZb"><br>
<br>
><br>
> - Accounting: on which frequency accounting data are saved on DB? This<br>
> is much important for us, as we will use this to invoice customers.<br>
> Will be possibile to touch the real number of seconds that an instance<br>
> was ON and the real number of seconds that an instance was paused but<br>
> with data still present on the node (no cpu/ram utilization but only<br>
> disk utilization)<br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
<br>
<br>
<br>
</div><span class="HOEnZb"><font color="#888888">--<br>
Ruben S. Montero, PhD<br>
Project co-Lead and Chief Architect<br>
OpenNebula - The Open Source Solution for Data Center Virtualization<br>
<a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:rsmontero@opennebula.org">rsmontero@opennebula.org</a> | @OpenNebula<br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
</div></div></blockquote></div><br>