Are you referring to /etc/sysconfig/iptables ? That's where the engine setup configures iptables, when I provision my nodes I select "Don't configure firewall" and let puppet manage my iptables rules for other reasons.. not sure if that was what you're asking On Tue, Oct 1, 2013 at 11:16 PM, Sven Kieske <S.Kieske(a)mittwald.de&gt; wrote:

On Tue, 1 Oct 2013, Sven Kieske wrote: SvenKieske appeared in the OFTC IRC channel #ovirt with this issue, and we discussed it some more 11:41 < SvenKieske> meaning you can't ping compute nodes, this is in the default install 11:41 < orc_orc> SvenKieske: * nod * that effect would occur with the physdev rule, I think 11:41 < SvenKieske> and I think this default iptables rule is just plain useless :) 11:42 < SvenKieske> and prevents proper network debugging, as we are having some issues with network related to newest ovirt nodes 11:42 < orc_orc> SvenKieske: assumedly you are following a guide. can you point out that URL and the step at which the problem is first noticed and he pointed to the wiki outline at: http://www.ovirt.org/Quick_Start_Guide#Install_oVirt_Node 11:43 < orc_orc> but from a policy POV, it may make sense that a node is not reachible until it has had time to become hardened .. and I also pointed out an example of an ICMP fragmantation attack and its remdiation in the Red Hat bugzilla and in IRC he there stated 11:45 < SvenKieske> I'm not sure you can harden this node any further, as it resides on a read only file system, beside that, I can not think of any attack vector via icmp on the compute node 11:46 < orc_orc> SvenKieske: there are some ICMP attacks, particularly on ipv6 stacks, which can cause machines to fall over and die 11:46 < orc_orc> I reported one a while back 11:47 < orc_orc> the packet reassembly code had an unsuspected re-construction method with a problem in it and at that point he concluded that perhaps the ICMP block limitation had policy reasons behind it 11:49 < SvenKieske> Well then that's fine with me, but maybe the node devs should more focus on reliable network configuration and then harden it for security and not the other way around, it was just a small nuisance, if network setup in 3.3 would work ootb I'd maybe never noticed ping doesn't work ootb to which I can only respond: 11:49 < orc_orc> SvenKieske: sounds like you are saying that you need to file an RFE as to debugging tools extensions or amend the setup documentation I had a private inquiry about KVM hardening and so had been looking at the physdev iptables rules recently, and on a VM for which I am responsible an incident just last weekend 11:50 < orc_orc> SvenKieske: I had a person at my office just today, who was the victim of a TOR attack on a VM 11:50 < orc_orc> so VM's _do_ get scanned for and attacked ... in part we mitigated the attack via a temporary iptables rule on the KVM based hypervisor ... and he closed that he may file something tomorrow. 11:50 < SvenKieske> yeah, might be the way to go, but my workday is over now, so maybe tomorrow :) 11:50 < orc_orc> SvenKieske * nod * don't forget ;) 11:51 < SvenKieske> I'm all in for more computer security :) 11:51 < SvenKieske> see you! 11:51 * orc_orc waves I've been working through the setup documentation as well since the 3.3 update, and have a list of questions as to the wiki materials, as of course bit rot happens in wiki's (heck, in _any_ documentation) as new releases are issued -- Russ herrold -- -- end ================================== .-- -... ---.. ... -.- -.-- Copyright (C) 2013 R P Herrold herrold(a)owlriver.com My words are not deathless prose, but they are mine.

Hi, ----- Original Message ----- Do you have on the management node also VDSM? The allinone plugin? Is that intended? You need it if you want to run VMs on it. VDSM manages networking on nodes (hypervisors), which includes the management node if you have chosen so during setup. Regards, -- Didi

when it does the initial install or upgrade. My iptables rules have been happily running for months.. ICMP returning an error/blocked message believe it's the last line in the iptables config file which ovirt configures in the initial install. On Wed, Oct 2, 2013 at 5:40 PM, Sven Kieske <S.Kieske(a)mittwald.de&gt; wrote:

Hi, ----- Original Message ----- Sorry, could not understand that from your message. Can you please provide the setup log? It's in /var/log/ovirt-engine/setup. On the management node, iptables rules are changed only during setup, if you choose so. vdsm-bootstrap was deprecated in 3.2 and replaced with ovirt-host-deploy. Both of them affect hypervisors, not the engine host. -- Didi