Um dude<br>That's the wrong place to run the agent if I'm reading this correctly.<br>You should be tuning an instance of the agent on every compute node<br><br><span style="font-family:Prelude, Verdana, san-serif;"><br><br></span><span id="signature"><div style="font-family: arial, sans-serif; font-size: 12px;color: #999999;">-- Sent from my HP Pre3</div><br></span><span style="color:navy; font-family:Prelude, Verdana, san-serif; "><hr align="left" style="width:75%">On Feb 18, 2013 11:44 PM, Shixiong Shang (shshang) <shshang@cisco.com> wrote: <br><br></span>
Hi, Perry:
<div><br>
</div>
<div>I guess I said "iptable rule allows DHCP" too early. :) I read the iptable entries one more time and here is the problem on quantum node running dhcp agent. </div>
<div><br>
</div>
<div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>[dmd@as-net1 ~]$ sudo iptables -L -n</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>Chain INPUT (policy ACCEPT)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>target prot opt source destination </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>quantum-l3-agent-INPUT all -- 0.0.0.0/0 0.0.0.0/0 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:9696 </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited </div>
</div>
<div><br>
</div>
<div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>Chain quantum-l3-agent-INPUT (1 references)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>target prot opt source destination </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>ACCEPT tcp -- 0.0.0.0/0 7.10.177.2 tcp dpt:8775 </div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>By this default setting, DHCP request from remote host (i.e. nova-compute) destined to UDP/67 is ACCEPTED, as we saw previously. However, the DHCP OFFER message, which is sent to UDP/68 is actually blocked. Considering this bi-directional communication,
I added the following line to "quantum-l3-agent-INPUT" chain and now my VM got IP address!!!!</div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>iptables -A quantum-l3-agent-INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT</div>
<div><br>
</div>
<div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>[dmd@as-net1 ~]$ sudo tcpdump -vvn -i tap335cc0a4-c7 | grep BOOTP/DHCP</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>tcpdump: listening on tap335cc0a4-c7, link-type EN10MB (Ethernet), capture size 65535 bytes</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok] BOOTP/DHCP, Request from fa:16:3e:98:7d:98, length 300, xid 0xa7c6d351, secs 3, Flags [none] (0x0000)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok] BOOTP/DHCP, Request from fa:16:3e:98:7d:98, length 300, xid 0xa7c6d351, secs 3, Flags [none] (0x0000)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> 192.168.178.2.bootps > 192.168.178.3.bootpc: [udp sum ok] BOOTP/DHCP, Reply, length 323, xid 0xa7c6d351, secs 3, Flags [none] (0x0000)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> 192.168.178.2.bootps > 192.168.178.3.bootpc: [udp sum ok] BOOTP/DHCP, Reply, length 323, xid 0xa7c6d351, secs 3, Flags [none] (0x0000)</div>
</div>
<div><br>
</div>
<div>Would you please fix this problem in the bug you referred to, or maybe create a new for tracking purpose? In the meanwhile, we still need to understand the SELinux problem mentioned earlier in the email thread. Right now, my SELinux is disabled, which
is not desired.</div>
<div><br>
</div>
<div>Thank you for the pointer, which truly forced me to think about it twice! Good night!</div>
<div><br>
</div>
<div>Shixiong</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
<div><br>
</div>
<div>
<div apple-content-edited="true">
<div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 13.5pt; font-family: Calibri, sans-serif; "><br class="Apple-interchange-newline">
</span></div>
</div>
</div>
</div>
<br>
<div>
<div>On Feb 18, 2013, at 7:58 PM, Perry Myers <<a href="mailto:pmyers@redhat.com">pmyers@redhat.com</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">On 02/18/2013 07:50 PM, Shixiong Shang (shshang) wrote:<br>
<blockquote type="cite">Hi, Chris:<br>
<br>
If I completely disabled SELinux, then dnsmasq process could start<br>
without any error. However, my VM still couldn't obtain IP address from<br>
the DHCP server. Based on tcpdump right on tap interface to which DHCP<br>
server was hooked up, I saw inbound DHCP Discover message from VM. But I<br>
never saw DHCP OFFER message returned back to VM. I checked dnsmasq host<br>
files and it contains the right mapping between VM MAC and IP<br>
address…..Anything could go wrong?<br>
</blockquote>
<br>
Maybe you're hitting this error?<br>
<a href="https://bugzilla.redhat.com/show_bug.cgi?id=889868">https://bugzilla.redhat.com/show_bug.cgi?id=889868</a><br>
<br>
Gary is working on that one, and we hope to have a fix in the next build<br>
of quantum to put out on RHN/CDN.<br>
<br>
There's an upstream patch in review:<br>
https://review.openstack.org/#/c/22183/<br>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>