Ubuntu Forums Archive Viewer

Must I configure the iptables for the CC in UEC?

Archived thread 1608503 from Ubuntu Cloud and Juju. Markdown source: Ubuntu_Cloud_and_Juju/thread_1608503_Must_I_configure_the_iptables_for_the_CC_in_UEC.md

Original URL About this archive
#1

Dear All,

I am constructing a UEC private cloud within my local network 192.168.123.0 (Gateway and DNS server are both 192.168.123.1). I cannot communicate from the NC on 192.168.20.2 out to the DNS server (or anywhere else outside of 192.168.20.X).

I am not clever so I have been scrupulously following steps in the Eucalyptus Beginner's Guide - UEC Edition while using the installation wizard for Ubuntu 10.10 Server (AMD64).

The configuration is intended to look like:

CLC (192.168.123.151) <-> switch1 <-> CC (eth0:192.168.123.152,eth1:192.168.20.1) <-> switch2 <-> NC (eth1:192.168.20.2)

I can ping the CLC from the CC, the NC from the CC, the CC from the NC but I cannot ping anywhere else from the NC.

The CLC interface is: auto eth0 iface eth0 inet static address 192.168.123.151 netmask 255.255.255.0 network 192.168.123.0 broadcast 192.168.123.255 gateway 192.168.123.1 # dns-* options are implemented by the resolvconf package, if installed dns-nameservers 192.168.123.1 dns-search oxil.co.uk

There is a switch between CLC and CC.

The CC interface is: auto eth0 iface eth0 inet static address 192.168.123.152 netmask 255.255.255.0 network 192.168.123.0 broadcast 192.168.123.255 gateway 192.168.123.1 # dns-* options are implemented by the resolvconf package, if installed dns-nameservers 192.168.123.1 dns-search oxil.co.uk

auto eth1 iface eth1 inet static address 192.168.20.1 netmask 255.255.255.0 network 192.168.20.0 broadcast 192.168.20.255

There is a different switch between CC and NC.

The NC interface is: auto eth0 iface eth0 inet manual

auto br0 iface br0 inet static address 192.168.20.2 netmask 255.255.255.0 network 192.168.20.0 broadcast 192.168.20.255 gateway 192.168.20.1 # dns-* options are implemented by the resolvconf package, if installed dns-nameservers 192.168.123.1 dns-search oxil.co.uk bridge_ports eth0 bride_fd 9 bridge_hello 2 bridge_maxage 12 bridge_stp off

In resolv.conf: search oxil.co.uk nameserver 192.168.123.1

A colleague suggests that the iptables have not been configured to pass traffic through the CC to the outer world.

On the CC "cat /proc/sys/net/ipv4/ip_forward" yields 1. It is at this point that I have stopped as I am reluctant to change iptable settings without any understanding.

Where should I go next?

Many thanks, Philip

#2

I have taken this from http://www.howtoforge.com/nat_iptables.

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE iptables --append FORWARD --in-interface eth1 -j ACCEPT

The communication out is now possible so something simple like "apt-get update" now works.

Is this the right thing to do? If so, where should I put it? I tried rc.local but it was ignored.