0

I have two openstack servers in the same network:

  • OpenStack server 1 having the IP: 192.168.25.9
  • OpenStack server 2 having the IP: 192.168.25.13

I have a tenant in each OpenStack server and I am trying to connect these tenants such that virtual machines in tenant 1 (10.0.6.0/24) can ping those in tenant 2 (10.1.5.0/24). However I can only use two floating IPs.

Therefore I create GW1 and GW2 for each tenant and I assign each GW a floating IP then I create an OpenVPN tunnel (10.7.0.0/24) between these gateways. This is illustrated in the architecture in the following picture.

Architecture Schematic

I reroute VM1 to use GW1 as gateway and GW1 to forward packets for network 10.1.5.0/24 through the tunnel interface tap0 with the IP address 10.7.0.1. (Same steps for VM2 and GW2)

However when I ping VM2 from VM1, GW1 receive the request and the response on its interface eth0. However the reply is not forwarded to VM1.

Gateways Iptables Rules:

I added the following iptable rules to each gateway:

  • iptables -t nat -A POSTROUTING -j MASQUERADE
  • iptables -P FORWARD ACCEPT

I enabled ipv4 forwarding in /etc/sysctl.conf

Can anyone help me ?

  • I found that the problem was at the bridges BR1 and BR2. I disabled the firewall of nova-network by adding the following line to /etc/nova/nova.conf: firewall_driver = nova.virt.firewall.NoopFirewallDriver then rebooted both servers in order to restore iptables configuration. And now it works ! – erach Sep 17 '15 at 14:17
  • Still don't know which rule is preventing packets from being forwarded on BR1 and BR2. Anyone can point me to how troubleshoot iptables ? – erach Sep 17 '15 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.