We are currently running iscsi in an open network and would like to migrate our iscsi to a separate vlan. Reading through the documentation this doesn't seem to be possible. Instead iet/iscsitarget seems to advertise the service on all the IP's of the iscsi target. Since not all of these IP addresses are available on our iscsi initators. Which in turn breaks our xen autostartup during boot (timeout too long).

Restricting the subnet in /etc/iet/initiators.allow and denying all in /etc/iet/initiators.deny doesn't seem to have the desired effect:

# /etc/iet/initiators.allow

# /etc/iet/initiators.deny

I think you should be able to bind your IET target to a specific interface (i.e. your iSCSI VLAN interface) by providing the -a <IPaddress> parameter upon startup.

Setting rp_filter and/or employing iptables rules (more expensive, but necessary if you have routing enabled for your iscsi subnet) should make sure that hosts are not able to reach the iSCSI VLAN target address through other interfaces or out of other subnets.

  • Ietd certainly supports starting with a specific address. Looking at the initscript it's unclear how to set this variable in debian. I certainly don't want to edit any initscripts. How would edit rp_filter solve this problem? Ietd seems to just parse the ifconfig and exports the interfaces. – Pascal Jan 24 '12 at 18:01
  • @Pascal I took a glance at the Debian/Ubuntu startup scripts for ietd and it is started as start-stop-daemon --start --exec $DAEMON --quiet --oknodo so obviously there is no parameter to set the IP interface address to bind to - you would have to either edit the original script or derive your own startup script and specify -a. rp_filter and iptables rules would be needed for additional security if you want to ensure that only members of your dedicated storage VLAN subnet are able to access the target on its new address. – the-wabbit Jan 24 '12 at 20:42
  • I don't think that this address bind option is going to help. For redundancy and migration, I would like to have the possibility to access ISCSI over both interfaces. I noticed the demon as well. That's why I wrote that I won't edit any initscripts. But I'll report this upstream. – Pascal Jan 25 '12 at 13:41
  • Well it seems that I'll have to stick with iptables blocking for now. Since this doesn't seem to be supported. – Pascal Jun 19 '12 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.