<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Giuseppe Ragusa" <giuseppe.ragusa@hotmail.com><br><b>To: </b>"Yedidyah Bar David" <didi@redhat.com><br><b>Cc: </b>"Users@ovirt.org" <users@ovirt.org><br><b>Sent: </b>Tuesday, March 25, 2014 1:53:20 AM<br><b>Subject: </b>RE: [Users] Otopi pre-seeded answers and firewall settings<br><div><br></div><style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style><div dir="ltr">Hi Didi,<br>I found the references to NETWORK/iptablesEnable in my engine logs (/var/log/ovirt-engine/host-deploy/ovirt-*.log), but it didn't seem to work after all.<br><div><br></div>Full logs attached.<br><div><br></div>I resurrected my Engine by rebooting the (still only) host, then restarting ovirt-ha-agent (at startup the agent failed while trying to launch vdsm, but I found vdsm running and so tried manually...).</div></blockquote><div><br></div><div>OK, so it's host-deploy that's doing that.</div><div>But it's not host-deploy itself - it's the engine that is talking to it, asking it to configure iptables.</div><div>I don't know how to make the agent don't do that. I searched a bit the sources (which I don't know)</div><div>and didn't find a simple way.</div><div><br></div><div>You can, however, try to override this by:</div><div># mkdir -p /etc/ovirt-host-deploy.conf.d</div><div># echo '[environment:enforce]' > /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf</div><div># echo 'NETWORK/iptablesEnable=bool:False' >> /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf</div><div><br></div><div>Never tried that, and not sure it's recommended - if it does work, it means that host-deploy will not</div><div>update iptables, but the engine will think it did. So it's better to find a way to make the engine not do</div><div>that. Or, better yet, that you'll explain why you need this and somehow make the engine do what you want...</div><div><span style="font-size: 12pt;">-- </span></div><div>Didi</div><div><br></div></div></body></html>