Read more

what to do if nova's iptables rules are missing

Claus-Theodor Riegg
November 09, 2015Software engineer at makandra GmbH

After restarting an OpenStack host you may encouter problems with missing iptables rules (we're on an quite old release of OpenStack currently. Maybe this is fixed in newer releases). The nova chains appear in the iptables -L output but they're empty. NAT is working fine. The reason is, that the NAT chains are configured by nova-network while the filter rules are managed by nova-compute. I didn't manage to find the cause of this behaivour yet, but I think it has something to do with the start order of the nova services. (When nova-network isn't present at nova-compute startup, no rules will be applied at all)

Illustration UI/UX Design

UI/UX Design by makandra brand

We make sure that your target audience has the best possible experience with your digital product. You get:

  • Design tailored to your audience
  • Proven processes customized to your needs
  • An expert team of experienced designers
Read more Show archive.org snapshot

You can restart the nova-compute service and nova should insert the rules one by one (you can see this with a tail -f on the nove-compute log). This shouldn't effect the state of your running VMs.

tail -F /var/log/nova/nova-compute.log &
sudo /etc/init.d/nova-compute restart

You have to wait some time until nova used all configured rules. (the time depends on the number of configured rules, the more rules the more time)

When looking at iptables -L again you should see, that the rules are present now.

Posted by Claus-Theodor Riegg to makandra dev (2015-11-09 11:56)