I have two openstack servers in the same network:

  • OpenStack server 1 having the IP:
  • OpenStack server 2 having the IP:

I have a tenant in each OpenStack server and I am trying to connect these tenants such that virtual machines in tenant 1 ( can ping those in tenant 2 ( However I can only use two floating IPs.

Therefore I create GW1 and GW2 for each tenant and I assign each GW a floating IP then I create an OpenVPN tunnel ( between these gateways. This is illustrated in the architecture in the following picture.

Architecture Schematic

I reroute VM1 to use GW1 as gateway and GW1 to forward packets for network through the tunnel interface tap0 with the IP address (Same steps for VM2 and GW2)

However when I ping VM2 from VM1, GW1 receive the request and the response on its interface eth0. However the reply is not forwarded to VM1.

Gateways Iptables Rules:

I added the following iptable rules to each gateway:

  • iptables -t nat -A POSTROUTING -j MASQUERADE
  • iptables -P FORWARD ACCEPT

I enabled ipv4 forwarding in /etc/sysctl.conf

Can anyone help me ?

  • I found that the problem was at the bridges BR1 and BR2. I disabled the firewall of nova-network by adding the following line to /etc/nova/nova.conf: firewall_driver = nova.virt.firewall.NoopFirewallDriver then rebooted both servers in order to restore iptables configuration. And now it works ! – erach Sep 17 '15 at 14:17
  • Still don't know which rule is preventing packets from being forwarded on BR1 and BR2. Anyone can point me to how troubleshoot iptables ? – erach Sep 17 '15 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.