Hi Gert -

I'm not sure what the issue is with your configuration, but I can tell you that we're on XenServer 6.1 (hotfix XS610E030) with iptables enabled with VLAN-based advanced networking, and have no issues with connectivity.

chkconfig iptables off will only prevent automatically starting the service for specific init levels at OS boot... so if something is manually restarting it due to cloud config, chkconfig won't have an impact.

One thing that I've noticed is that if you need to restart iptables on the XenServer host, the rules do not get refreshed properly. The host itself does NOT store all of the rules required for use with CloudPlatform - some of the rules are dynamically populated when the server transitions to an "up" state.

My iptables file looks very similar to yours... however, if you run "iptables -L", you should see MANY more rules in the current list that are not in the configuration file - many of them configured for the bridged interfaces that CCP creates when you use advanced networking. I'd recommend putting the server in maintenance mode and rebooting it so that it grabs the correct rules configuration from CloudPlatform... then don't mess with iptables... let CCP handle it for you and see if that works.

K

Hello kbacheI903,

Thank you for your reply.

I have tried to let CS "do its thing" with iptables, but the buttom line is that,
i can not have 2 vms on different hosts communicate with each other if iptables service is on.

I have tried waiting 4 hours after restart to see if something happens, but no.

I am trying to figure out how to monitor the iptables deny rules..

I would like to have CS compleatly control my iptables but it is just not working for me.. :)

Kind regards
Gert

Hi Gert -

iptables -L (or iptables --list) will show you all of the current iptables rules that are in memory - that includes anything that has been added, removed, changed, reordered, etc. - basically, anything that is currently active.

I do think you'll need to fix the actual problem, though - the thing with iptables is that even if you stop the service, anything that modifies the iptables rule list will auto-start the service:

# service iptables stop
iptables: Flushing firewall rules: OK
iptables: Setting chains to policy ACCEPT: filter OK
iptables: Unloading modules: OK

# service iptables status
iptables: Firewall is not running.

# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

# iptables -A INPUT -p icmp -j ACCEPT

# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

K

hello,

yes i agree with you that i need to figure out why i do not get traffic through, but do you know
which log file i can se some info in ? :)

Kind regards
Gert