| *** SridarK has quit IRC | 00:10 | |
| *** yamamoto has quit IRC | 02:24 | |
| *** yamamoto has joined #openstack-fwaas | 02:30 | |
| *** https_GK1wmSU has joined #openstack-fwaas | 02:31 | |
| *** https_GK1wmSU has left #openstack-fwaas | 02:34 | |
| *** yamamoto has quit IRC | 02:35 | |
| *** yamamoto has joined #openstack-fwaas | 02:36 | |
| *** yamamoto has quit IRC | 02:41 | |
| *** yamamoto has joined #openstack-fwaas | 02:45 | |
| *** chandanc has joined #openstack-fwaas | 02:46 | |
| *** yamamoto has quit IRC | 03:33 | |
| *** yushiro has joined #openstack-fwaas | 03:47 | |
| yushiro | chandanc, hi. | 03:48 |
|---|---|---|
| *** yamamoto has joined #openstack-fwaas | 03:49 | |
| reedip | yushiro : hi | 03:53 |
| yushiro | reedip, hi | 03:53 |
| reedip | sorry my PC crashed last night so I didnt get to see the end of the meeting | 03:53 |
| reedip | yushiro : do we need to continue on https://review.openstack.org/#/c/486377/ ? | 03:53 |
| yushiro | oh, I understood. That's why you suddenly logged out.. | 03:53 |
| reedip | I merged the changes in https://review.openstack.org/#/c/488438/2 | 03:54 |
| yushiro | OK, If you merged my patch to your one, I'll abandoned it. | 03:54 |
| yushiro | no need to keep opening. | 03:55 |
| reedip | yushiro : I merged my patch into yours ! | 03:55 |
| reedip | DONT ABANDON YOUR PATCH :D | 03:55 |
| yushiro | OK. | 03:55 |
| yushiro | ahaw | 03:55 |
| yushiro | aha | 03:55 |
| yushiro | I see. Thanks for your work :) | 03:55 |
| reedip | anyways .. I think the V1 code needs to be updated for 1614680 | 03:55 |
| yushiro | I'll check it later. ( I just arrived at my office) | 03:55 |
| reedip | as we discussed yesterday | 03:56 |
| yushiro | OK. | 03:56 |
| yushiro | I'll fix both v1 and v2 | 03:56 |
| reedip | ok .. give me some time, I also found some information about the multiple firewall policy association with the rules.. will push a patch on it today | 03:56 |
| yushiro | I wanted to discuss about it yesterday but my turn(l2-agent) took so long and I couldn't discuss. | 03:57 |
| yushiro | sorry | 03:57 |
| reedip | sent you the chat logs, which I saved long back | 04:01 |
| *** yamamoto has quit IRC | 04:05 | |
| yushiro | thanks, just got | 04:05 |
| yushiro | hmm, we discussed that 'firewall_policies' attribute should be inserted into 'firewall_rule' | 04:07 |
| yushiro | I just concerned about Sridar could see this conversation or not :) | 04:07 |
| yushiro | Anyway, I think it's OK to implement. | 04:08 |
| *** yamamoto has joined #openstack-fwaas | 04:10 | |
| *** yamamoto has quit IRC | 04:50 | |
| openstackgerrit | Reedip proposed openstack/neutron-fwaas master: [WIP]Add firewall_policy_id in FWaaS v2 https://review.openstack.org/370731 | 05:05 |
| reedip | yushiro : updated patch ^^ | 05:05 |
| *** vks1 has joined #openstack-fwaas | 05:06 | |
| *** vks1 has quit IRC | 05:06 | |
| *** yamamoto has joined #openstack-fwaas | 05:07 | |
| *** vks1 has joined #openstack-fwaas | 05:09 | |
| *** SridarK has joined #openstack-fwaas | 05:14 | |
| yushiro | reedip, thanks. | 05:14 |
| yushiro | reedip, but please wait.... | 05:14 |
| yushiro | SridarK, hi | 05:17 |
| SridarK | yushiro: hi | 05:20 |
| yushiro | SridarK, Good afternoon. I realized that v2 cannot check 'position' of firewall-rule. Is 'position' hidden parameter for user? | 05:24 |
| SridarK | yushiro: hmm let me see | 05:25 |
| yushiro | In v1, firewall_rule : firewall_policy is 1 by 1 relation. As a result, 'position' can check in firewall_rule dict after associated with firewall_policy | 05:26 |
| yushiro | Now, we are discussing about a relation between firewall_policy and firewall_rule for v2 | 05:28 |
| SridarK | yushiro: yes, the firewall_policy_rule_associations_v2 table tracks the position of rule for a particular policy | 05:29 |
| SridarK | with v1 was simple we tracked the policy id and position as part of the rule db row | 05:29 |
| yushiro | Yes | 05:30 |
| yushiro | So, in v2, firewall_rule can associate multiple policies, right? | 05:31 |
| SridarK | yushiro: yes exactly | 05:32 |
| yushiro | If so, firewall_rule must have an attribute named 'firewall_policies' which is a list of dict as follows: | 05:32 |
| SridarK | yes that area with the show commands is broken | 05:33 |
| yushiro | [{'firweall_policy_id': <firewall-policy-id>, 'position': <position_num>}, {...}] | 05:33 |
| SridarK | yes - i think we only break the show cmd of a rule | 05:33 |
| SridarK | it is a lower priority - i think if we can get our other things lined up we can get this in | 05:34 |
| yushiro | OK, now reedip is try to fix it: https://review.openstack.org/370731 | 05:34 |
| SridarK | yes | 05:34 |
| yushiro | I'll comment his patch about our discussion result. Thank you. | 05:34 |
| yushiro | SridarK, agree this is lower priority | 05:34 |
| yushiro | I'd like to specify a decision for implementation :) | 05:35 |
| SridarK | how is the L2 agent stuff coming along | 05:35 |
| yushiro | hmm, I ping to chandanc but no response.. | 05:36 |
| SridarK | lets evaluate over the next 2 days | 05:36 |
| SridarK | and decide | 05:36 |
| yushiro | yes | 05:36 |
| SridarK | I am hoping we can get the Horizon changes in | 05:36 |
| yushiro | Yes, sure. | 05:36 |
| SridarK | If u see SarathMekala come online in a few hours can u remind him to prepare for FFE | 05:37 |
| yushiro | SridarK, of course. | 05:37 |
| SridarK | i think we can land this | 05:37 |
| SridarK | i think he put together an etherpad for setup - i would like to test more as he churns the patches | 05:38 |
| yushiro | yeah | 05:38 |
| yushiro | Now, I'm rebuilding my devstack env with horizon patch | 05:39 |
| SridarK | so we can be confident - IMHO - that will improve user experience and encourage more folks to try | 05:39 |
| SridarK | yushiro: o | 05:39 |
| SridarK | *ok | 05:39 |
| yushiro | Yes, I'd like to comment more on horizon patch from a user point of view. | 05:40 |
| SridarK | yushiro: +1 | 05:40 |
| *** vks1 has quit IRC | 05:53 | |
| *** vks1 has joined #openstack-fwaas | 06:03 | |
| *** SridarK has quit IRC | 06:08 | |
| reedip | Just caught up with the logs | 06:11 |
| openstackgerrit | Yushiro FURUKAWA proposed openstack/neutron-fwaas master: FWaaS v2 extension for L2 agent https://review.openstack.org/323971 | 06:21 |
| openstackgerrit | Yushiro FURUKAWA proposed openstack/neutron-fwaas master: Generate default firewall group via project https://review.openstack.org/425769 | 06:21 |
| openstackgerrit | Yushiro FURUKAWA proposed openstack/neutron-fwaas master: OVS based l2 Firewall driver for FWaaS v2 https://review.openstack.org/447251 | 06:21 |
| openstackgerrit | Reedip proposed openstack/neutron-fwaas master: [WIP]Add firewall_policy_id in FWaaS v2 https://review.openstack.org/370731 | 06:23 |
| yushiro | chandanc, If you have time, could you check https://etherpad.openstack.org/p/fwaas-v2-l2-agent in OF rule difference section? | 06:32 |
| yushiro | I pasted 'ovs-ofctl dump-flows br-int' before/after VM create/delete | 06:33 |
| reedip | yushiro : I have a very simple question. but not able to solve it | 07:05 |
| reedip | I have 2 VMs : VM - A on Ubuntu Host A | 07:05 |
| reedip | VM- B on Ubuntu Host B | 07:05 |
| reedip | both hosts have a different IP address | 07:06 |
| reedip | I want VM-A to ping VM-B without VxLAN | 07:06 |
| yushiro | yup | 07:06 |
| reedip | do you have any idea how to do it ? | 07:06 |
| yushiro | let me check more.. Is network_type is 'vxlan' ? | 07:08 |
| reedip | no | 07:08 |
| yushiro | What are you using 'network_type' ? | 07:08 |
| reedip | no this is not openstack :) | 07:08 |
| yushiro | not openstack, OK | 07:09 |
| reedip | this is a normal unix query :) | 07:09 |
| yushiro | VM:A and VM:B are private IP address, right? and these VMs cannot access from external HOST A/B | 07:10 |
| reedip | VM A , VM B are on Pvt IP address | 07:10 |
| reedip | They are not Bridged , so VM B cannot be accessed from HOST A | 07:11 |
| yushiro | OK | 07:11 |
| yushiro | I think it is possible to communicate by setting NAT(iptables) on HOST A and B | 07:12 |
| reedip | pre routing and post-routing ? | 07:13 |
| yushiro | prerouting | 07:17 |
| yushiro | NAT and port forward | 07:17 |
| reedip | pre routing in A and Post routing in B , right ? | 07:17 |
| yushiro | yes maybe. | 07:19 |
| yushiro | e.g. VMA -> VMB (http) VMA tries to access HOSTB:10080 In hostB, port-forwad should be set (host:10080 -> VMB:80 ) | 07:21 |
| reedip | hmm | 07:21 |
| yushiro | I think it's OK for same approach even if a protocol is icmp | 07:22 |
| yushiro | Although I don't fully understand your environment yet ;) | 07:23 |
| reedip | yushiro : but now we would have masquearading :) | 07:24 |
| reedip | sudo iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE -s X.X.X.X | 07:25 |
| yushiro | iptables -t nat -A PREROUTING -m tcp -p tcp --dst 192.168.1.30 --dport 1234 -j DNAT --to-destination 10.0.2.50:80 | 07:30 |
| yushiro | iptables -t nat -A POSTROUTING -m tcp -p tcp --dst 10.0.2.50 --dport 80 -j SNAT --to-source 10.0.2.40 | 07:30 |
| yushiro | I mean pre/post routing is like that | 07:30 |
| reedip | I got confused in the postrouting part | 07:32 |
| yushiro | prease read 192.168.1.30 and 10.0.2.40 are HOSTB addresses | 07:32 |
| yushiro | If we don't do POSTROUTING, unknown source IP address exists for VMB | 07:33 |
| yushiro | HOST has 2 IP addresses ( Outside address and private address ) | 07:34 |
| reedip | hmm | 07:34 |
| reedip | is 192 the inside IP ? | 07:34 |
| yushiro | changing source IP address to HOST B's private IP address, VM B can understand where is source IP address. | 07:34 |
| yushiro | no, outside | 07:34 |
| yushiro | 10.0.2.40 is inside IP for HOSTB | 07:35 |
| reedip | ok ... | 07:35 |
| reedip | lemme check | 07:35 |
| reedip | so we have host B ( 192.168.1.30 ) with the VM deployed as 10.0.2.40 , right ? | 07:37 |
| reedip | or do you mean that host B has one IP to the external network ( 192.168.1.30 ) and one to the internal network ( 10.0.2.40 ) with the VM deployed as 10.0.2.50 | 07:38 |
| yushiro | outside IP: 192.168.1.0, VM IP: 10.0.2.0 | 07:38 |
| yushiro | ah, latter case is correct | 07:38 |
| reedip | hmm | 07:38 |
| reedip | let me try | 07:39 |
| yushiro | I think host as at least 1 private IP address to communicate to VM instances. | 07:39 |
| reedip | yeah | 07:39 |
| yushiro | s/host/host has/ | 07:39 |
| reedip | yushiro : the prerouting seems correct but the postrouting seems confusing still | 07:50 |
| reedip | iptables -t nat -A POSTROUTING -m tcp -p tcp --dst 10.0.2.50 --dport 80 -j SNAT --to-source 10.0.2.40 : Why would the --dst be 10.0.2.50 , wont it be --src ? | 07:51 |
| yushiro | hmm, because VM:B cannot solve VM:A's IP address | 07:54 |
| yushiro | As a result, reply from VM:B tries to send default gateway | 07:54 |
| yushiro | In this case, they cannot communicate. | 07:55 |
| reedip | 10.0.2.40 is the Pvt IP of HostB | 07:55 |
| reedip | 10.0.2.50 is the IP of the VM B | 07:55 |
| yushiro | yes | 07:55 |
| reedip | if we consider 10.0.2.30 the IP of VM A | 07:55 |
| reedip | then the postrouting on Host A would be iptables --table nat -A POSTROUTING --dst 10.0.2.50 --out-interface eth0 -j MASQUERADE -s 10.0.2.30 | 07:56 |
| reedip | is that right ? | 07:56 |
| yushiro | hmm, why you did MASQUERADE? You said it has already configured. | 07:58 |
| reedip | no , it hasnt , I checked it now ... | 07:59 |
| reedip | I am trying to exepriment and not able to complete it.. thats why trying to understand | 07:59 |
| reedip | should I not masquarade ? | 07:59 |
| yushiro | OK, what are you using hypervisor? | 08:01 |
| yushiro | KVM ? | 08:01 |
| yushiro | If you use KVM and default network, no need to configure MASQUARADE. | 08:02 |
| reedip | virtmanager | 08:02 |
| reedip | not a default network | 08:02 |
| reedip | i mean libvirt | 08:02 |
| yushiro | OK | 08:02 |
| yushiro | Can VMA communicate with HOST B? | 08:03 |
| yushiro | or internet? | 08:03 |
| reedip | Nope | 08:03 |
| reedip | it cannot | 08:04 |
| reedip | Ok , I added a route and now it can | 08:06 |
| yushiro | It's OK whatever VM can access to outside :) | 08:07 |
| yushiro | After that, adding above pre/post rule into iptables makes VM:A connect to VM:B with individual port (SSH, HTTP or ICMP) | 08:08 |
| reedip | but I verified and now I can see that the IP is being masquaraded :) | 08:08 |
| reedip | ran tcpdump on host A , and ran ping from VM A on HOST B : Seeing ICMP ECHO from Host A to Host B :D | 08:09 |
| reedip | pretty complicated , the virsh is | 08:09 |
| yushiro | in libvirt, all of VM IP address is Natted to host IP address I think | 08:10 |
| yushiro | that is masquarade | 08:10 |
| reedip | Yes , I think so too | 08:10 |
| yushiro | So, you can add SNAT DNAT rule into pre/post for individual port number. | 08:10 |
| reedip | Hmm ... | 08:10 |
| reedip | ok | 08:10 |
| yushiro | and pass filter for FORWARD table | 08:11 |
| reedip | yushiro : thanks a lot .. I will ping you if there is any further issue | 08:14 |
| reedip | :) | 08:14 |
| yushiro | OK. Sorry for confusing my unstable English ... | 08:14 |
| reedip | no, its good :) | 08:16 |
| yushiro | thanks | 08:17 |
| *** openstackgerrit has quit IRC | 08:33 | |
| reedip | yushiro what did you say about the Forward table ? | 10:29 |
| *** chandanc has quit IRC | 11:12 | |
| *** openstackgerrit has joined #openstack-fwaas | 11:19 | |
| openstackgerrit | YAMAMOTO Takashi proposed openstack/neutron-fwaas-dashboard master: tox_install: Don't leave IFS set https://review.openstack.org/489977 | 11:19 |
| openstackgerrit | Hunt Xu proposed openstack/neutron-fwaas master: Use configurable conntrack driver in fwaas_v2 https://review.openstack.org/489980 | 11:26 |
| *** vks1 has quit IRC | 11:52 | |
| *** yamamoto has quit IRC | 13:02 | |
| *** yamamoto has joined #openstack-fwaas | 13:18 | |
| *** yamamoto has quit IRC | 13:55 | |
| -openstackstatus- NOTICE: We have disable infracloud-vanilla due to the compute host running mirror.regionone.infracloud-vanilla.o.o being offline. Please recheck your failed jobs to schedule them to another cloud. | 13:56 | |
| *** reedip_ has joined #openstack-fwaas | 14:46 | |
| reedip_ | hey | 14:46 |
| *** yamamoto has joined #openstack-fwaas | 14:55 | |
| xgerman_ | hi | 14:56 |
| *** yamamoto has quit IRC | 15:00 | |
| *** chandanc has joined #openstack-fwaas | 15:14 | |
| *** chandanc has quit IRC | 15:25 | |
| *** vks1 has joined #openstack-fwaas | 15:26 | |
| reedip_ | whats up ? | 15:27 |
| *** reedip_ has quit IRC | 15:32 | |
| xgerman_ | the usual… lot’s of work… let me know if you need any help… | 15:43 |
| *** Tim_Eberhard has joined #openstack-fwaas | 16:48 | |
| *** vks1 has quit IRC | 17:53 | |
| *** Tim_Eberhard has quit IRC | 18:27 | |
| *** Tim_Eberhard has joined #openstack-fwaas | 18:28 | |
| *** Tim_Eberhard has quit IRC | 18:28 | |
| *** vishwana_ has joined #openstack-fwaas | 20:23 | |
| *** vishwanathj has quit IRC | 20:26 | |
| *** yamamoto_ has joined #openstack-fwaas | 21:08 | |
| *** yamamoto_ has quit IRC | 21:15 | |
| *** yamamoto_ has joined #openstack-fwaas | 21:17 | |
| *** Tim_Eberhard has joined #openstack-fwaas | 21:26 | |
| *** Tim_Eber_ has joined #openstack-fwaas | 21:27 | |
| *** Tim_Eber_ has quit IRC | 21:28 | |
| *** Tim_Eberhard has quit IRC | 21:30 | |
| *** vishwana_ has quit IRC | 21:45 | |
| *** vishwanathj has joined #openstack-fwaas | 21:45 | |
| *** vishwanathj has quit IRC | 22:16 | |
| *** vishwanathj has joined #openstack-fwaas | 22:16 | |
| openstackgerrit | YAMAMOTO Takashi proposed openstack/neutron-fwaas-dashboard master: tox_install: Don't leave IFS set https://review.openstack.org/489977 | 22:19 |
| *** yamamoto_ has quit IRC | 22:29 | |
| *** yamamoto has joined #openstack-fwaas | 22:32 | |
| *** yamamoto has quit IRC | 22:36 | |
| *** yamamoto has joined #openstack-fwaas | 22:41 | |
| *** yamamoto has quit IRC | 22:44 | |
| *** yamamoto has joined #openstack-fwaas | 22:56 | |
| *** yamamoto has quit IRC | 23:11 | |
| *** yamamoto has joined #openstack-fwaas | 23:14 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!