Posted over 3 years ago. Visible to the public.

what to do if nova's iptables rules are missing

After restarting an OpenStack host you may encouter problems with missing iptables rules (we're on an quite old release of OpenStack currently. Maybe this is fixed in newer releases). The nova chains appear in the iptables -L output but they're empty. NAT is working fine. The reason is, that the NAT chains are configured by nova-network while the filter rules are managed by nova-compute. I didn't manage to find the cause of this behaivour yet, but I think it has something to do with the start order of the nova services. (When nova-network isn't present at nova-compute startup, no rules will be applied at all)

You can restart the nova-compute service and nova should insert the rules one by one (you can see this with a tail -f on the nove-compute log). This shouldn't effect the state of your running VMs.

Copy
tail -F /var/log/nova/nova-compute.log & sudo /etc/init.d/nova-compute restart

You have to wait some time until nova used all configured rules. (the time depends on the number of configured rules, the more rules the more time)

When looking at iptables -L again you should see, that the rules are present now.

Once an application no longer requires constant development, it needs periodic maintenance for stable and secure operation. makandra offers monthly maintenance contracts that let you focus on your business while we make sure the lights stay on.

Owner of this card:

Avatar
Claus-Theodor Riegg
Last edit:
over 2 years ago
by Claus-Theodor Riegg
About this deck:
We are makandra and do test-driven, agile Ruby on Rails software development.
License for source code
Posted by Claus-Theodor Riegg to makandra dev
This website uses cookies to improve usability and analyze traffic.
Accept or learn more