I set up an OpenStack Folsom (2012.2) multi-node, single-network infrastructure. Everything runs fine, instances are running good on any compute node, private network works like a charm and all instances are reachable via Floating IPs from the outside and can reach the outside.
But when trying to perform a network request from a VM to itself via it's Floating IP it fails.
Neither ping nor ssh are working.
Security Groups are all open.
Ping works via Floating IPs from one VM to another but SSH don't.
Some data for one example
- 10.0.0.0/24 is the private network
- 10.0.0.1 is the controller
- 10.1.100.0/24 is the Floating IP network
- the VM with 10.0.0.13 has the Floating IP 10.1.100.4
iptables entries (regarding 10.1.100.4/10.0.0.13) on the controller (all services including network):
-A nova-network-2.7-OUTPUT -d 10.1.100.4/32 -j DNAT --to-destination 10.0.0.13 -A nova-network-2.7-PREROUTING -d 10.1.100.4/32 -j DNAT --to-destination 10.0.0.13 -A nova-network-2.7-float-snat -s 10.0.0.13/32 -o eth0 -j SNAT --to-source 10.1.100.4
iptables entries on the compute node:
-A nova-compute-2.7-local -d 10.0.0.13/32 -j nova-compute-2.7-inst-143
-N nova-compute-2.7-inst-143 -A nova-compute-2.7-inst-143 -m state --state INVALID -j DROP -A nova-compute-2.7-inst-143 -m state --state RELATED,ESTABLISHED -j ACCEPT -A nova-compute-2.7-inst-143 -j nova-compute-2.7-provider -A nova-compute-2.7-inst-143 -s 10.0.0.1/32 -p udp -m udp --sport 67 --dport 68 -j ACCEPT -A nova-compute-2.7-inst-143 -s 10.0.0.0/24 -j ACCEPT -A nova-compute-2.7-inst-143 -p tcp -m tcp --dport 22 -j ACCEPT -A nova-compute-2.7-inst-143 -p tcp -m tcp --dport 3389 -j ACCEPT -A nova-compute-2.7-inst-143 -p tcp -m multiport --dports 1:65535 -j ACCEPT -A nova-compute-2.7-inst-143 -p udp -m multiport --dports 1:65535 -j ACCEPT -A nova-compute-2.7-inst-143 -p icmp -j ACCEPT -A nova-compute-2.7-inst-143 -j nova-compute-2.7-sg-fallback
Any suggestions where to search for the problem are welcome. Of course I will provide any necessary data to solve the problem. Currently I am not quite sure which data would help.