<div dir="ltr"><div><div><div><div><div><div><div><div><div><div><div><div>Hello Galimba,<br><br></div>I would like to kindly welcome you to the magic world of Cloud Computing :). I think<br>your decision to use OpenNebula for your needs was a wise one. A road filled<br>
with fun, amusement and sometimes frustrations lay ahead. Enjoy.<br><br></div>When I've first read your E-Mail I thought at exactly the same solution as the one<br>pointed out by you, connect to the firewall and modify the iptables rules. I would<br>
choose to modify them via a hook [1] because I don't like to mangle with deploy.<br><br></div>You might ask why is that? In case of update in the future you don't have to worry<br></div>that your deploy script gets overwritten. Another safe option would be to copy<br>
the whole virtualization manager and name it kvm-local and modify the deploy<br>script there and update the hosts to use that driver.<br><br></div>Another solution that came to mind is to define a pseudo public network in ONE<br>
</div>using a desired private range. Then map the last octet from you public range with<br></div>the one in this private range. Easier to remember, though your users might not<br>agree. I think it's easier if I write an example.<br>
<br></div>Public: X.Y.Z.*100* <> Private: 172.16.0.*100*<br></div><br></div>On the firewall you would have to DNAT each of those one 100 IP addresses to each<br>of those private ones. You would have to do this once. For speed you can generate<br>
the rules with a basic for.<br><br></div>Next step would be to hold [2] all the IPs from the private network (pseudo public)<br>that you don't have available in the Public range.<br><br></div><div>Not elegant, not user friendly but a (working) solution non the less.<br>
</div><div><br>The most elegant solution I am aware of would be to create a VLAN subinterface<br>for that /25 range on the firewall and configure a true public network inside ONE. <br></div><div>It could even be done with bridging only without the hassle of setting up VLANs.<br>
</div><div>But you need to be able to partition your network in this manner. It might not<br>work for you.<br></div><div><br></div><div>You're challenge is a really interesting one and I would like to hear other people<br>
</div><div>opinions and possible solutions. It gave me food for thought and I am grateful for<br>that.<br></div><div><br>[1]: <a href="http://docs.opennebula.org/4.4/integration/infrastructure_integration/hooks.html">http://docs.opennebula.org/4.4/integration/infrastructure_integration/hooks.html</a><br>
[2]: <a href="http://docs.opennebula.org/4.4/user/virtual_resource_management/vgg.html">http://docs.opennebula.org/4.4/user/virtual_resource_management/vgg.html</a><br><br></div><div>Best,<br></div><div>Valentin<br><br></div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 20, 2014 at 12:27 AM, Galimba <span dir="ltr"><<a href="mailto:galimba@gmail.com" target="_blank">galimba@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hello everyone. <br clear="all"><div>My name is Sebastian. I'm new to this list and tho I've been a sysadmin for several years now, I've only recently dived into Cloud Computing.<br>I have successfully installed OpenNebula 4.4 on a local computer behind a firewall at my university. I set up two nodes and another dedicated computer as a NFS datastore.<br>
</div><div>The plan is to provide my research group with the IAAS that OpenNebula brings to the table.<br></div><div>At the moment, I'm dealing with an issue I haven't been able to solve, and perhaps some of you could throw me a hint.<br>
My university assigned me over 100 public ip addresses to provide each VM. If I were to plug the cable directly to the OpenNebula box, then I know I could create my templates with public ip addresses and then everything should be fine. The problem is that I have a firewall in the middle, managing all the public ips, and my OpenNebula box is on a LAN behind that firewall.<br>
</div><div>Is there an easy (and safe) way to assign public ips and pass tru the iptables on the firewall? I mean... the only solution I came up with was to modify the deploy script on the OpenNebula box to connect to the firewall and modify the iptables rules regarding the particular VM I'm trying to deploy. That's not a very happy solution.<br>
</div><div>Thanks in advance.<span class="HOEnZb"><font color="#888888"><br></font></span></div><span class="HOEnZb"><font color="#888888"><div>galimba<br></div><div><br>-- <br><div dir="ltr"><img src="http://i.imgur.com/6FbpMB1.jpg"><br>
</div>
</div></font></span></div>
<br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr">Valentin Bud<div><a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro" target="_blank">valentin@databus.pro</a></div>
</div>
</div>