4,435 reputation
1320
bio website taz.net.au/blog
location Australia
age 47
visits member for 5 years, 5 months
seen Dec 11 '13 at 0:06

Craig Sanders

http://taz.net.au/~cas/


Aug
4
awarded  Good Answer
Jul
12
awarded  Yearling
Jun
18
awarded  Enlightened
Jun
18
awarded  Nice Answer
Jun
8
awarded  Enlightened
Jun
8
awarded  Nice Answer
Mar
13
awarded  linux
Dec
6
awarded  Popular Question
Nov
6
awarded  Good Answer
Jul
12
awarded  Yearling
Mar
18
awarded  Revival
Jan
7
awarded  Enlightened
Jan
7
awarded  Nice Answer
Dec
23
awarded  Necromancer
Oct
15
answered Immediate logout after login with PAM, Kerberos, and LDAP
Sep
12
comment openstack, bridging, netfilter and dnat
yes. we've also contacted the supplier of our systems, who have contacted supermicro on our behalf. In my experience, you're better off pro-actively looking for a solution yourself than passively waiting for a vendor. maybe they will come up with a solution first. if so, great. if not, then we haven't wasted time waiting for them.
Sep
12
revised openstack, bridging, netfilter and dnat
added info about problem occuring even without openstack or libvirt installed.
Sep
11
comment openstack, bridging, netfilter and dnat
yeah, quite a few (and each VM started by openstack has its own chain with its own rules). we tested that other iptables rules work, the only one affected adversely by setting net.bridge.bridge-nf-call-iptables=0 is the DNAT rule, i think because its the only rule that affects packets that never leave the compute node's bridge interface.
Sep
10
comment openstack, bridging, netfilter and dnat
no, they shouldn't. tcpdump shows the DNS request packets going out, AND the reply packets coming back in. In 3.x kernels, they're dropped (not all, but most...which implies a bug) if net.bridge.bridge-nf-call-iptables=1 (the default), but not dropped if we set it to 0, but that disables the DNAT we need. in 2.6.32 they're not dropped at all, even with the default bridge-nf-call-iptables=1.
Sep
10
revised openstack, bridging, netfilter and dnat
added 102 characters in body