what to do if nova's iptables rules are missing
After restarting an OpenStack host you may encouter problems with missing iptables rules (we're on an quite old release of OpenStack currently. Maybe this is fixed in newer releases). The nova chains appear in the
iptables -L output but they're empty. NAT is working fine. The reason is, that the NAT chains are configured by
nova-network while the filter rules are managed by
nova-compute. I didn't manage to find the cause of this behaivour yet, but I think it has something to do with the start order of the nova services. (When
nova-network isn't present at
nova-compute startup, no rules will be applied at all)
You can restart the
nova-compute service and nova should insert the rules one by one (you can see this with a
tail -f on the nove-compute log). This shouldn't effect the state of your running VMs.
tail -F /var/log/nova/nova-compute.log & sudo /etc/init.d/nova-compute restart
You have to wait some time until nova used all configured rules. (the time depends on the number of configured rules, the more rules the more time)
When looking at
iptables -L again you should see, that the rules are present now.