On Mon, Dec 30, 2013 at 09:39:58PM +0100, woswas denni wrote:
> Well, there's nothing much beyond the hook's README
> You should start by defining a libvirt network, and then mark a vNIC
> profile with a custom propery so that the network is used by vNICs.
> As a very first stage, you may define the libvirt network on top of your
> existing br0 bridge
) so oVirt can
> consume your networking setup.
Hmm do we really need a libvirt bridge or cant we go simply with a regular
virtual brdige as i already use?
The extnet hook expects that you create a libvirt network on top of your
regular nic. You chould write your own "extbridge" hook, that consumes
the regular bridge directly.
The libvirt network may seem as a needless layer, but it grants the
extnet bridge a lot of flexibility (such as connecting to an ovs bridge
instead of to a Linux bridge).
all i want is connect ovirts vlan nic to existing interfaces.
iam aware tat then many configs has to be done manually, but thats fine for
Understood, and that's doable.
> But who creates that VPN connection? Who supplies the credentials?
well this is manually, only once per host no desire for automation here,
ive automated scripts for that but i usually use an offline pc as a signing
Understood. I am asking since I'd like to understand how people (plan
to) use oVirt, and wether we can automate more of their chores.
> How does this work, if they are both behind NAT?
Well they are not and they are, its a routed NAT combo :)
Lets say i have 2 server - we would have then 3 internal networks -
1 - VPN conncting and routing between physical hosts
2&3 - Each hosts internal bridge subnet which does routing
NAT comes in when we go outside - usually Portforward - which is handy to
So think of every Host not only as an Hypervisor but also as an Network Node
only downside if i move a vm from a to b ife to adjust the ips l, nat and
upside and reson for this is:
1, i can use one ext ip for several vms if they need different ports. atm i
can save over 3/4 of ext ips.
2, also i do not need to manage the firewall on every vm only on the hosts
3, Additional Security by having all Daemons whatsoever only bound to
all daemons are bound to their internal br0 ip and i can easy access
certain ports like ssh or mysl within the vpn only without exposing
anything outside with a minimum administrative work
Who can access what is currently defined by Firewall Rules within each Host
- Here comes Firewallbuilder Handy BTW :)))
> You'd like to automate the creation of NAT rules? VPN creation?
well i would like to automate port based nat and firewallrules thats the
dream. VPN as described i dont really but but hey who knows if someone else
Actually i think (even im not gonna need it) would be a nice feature for
many - specielly these days
only portforwarding/and or complete nat on the host would make live easier.
however most importingly is that i get the thing running.
even it means manual config on each host
my issues with ovirt where simple that i couldn find a way to assign the
needed interfaces. so if i simply manually specify whats going on it should
btw i took a look at openqrm and they have alreaey adressed many of those
needs like puppet, dhcp , dns and nat translation over ip pools and stuff.
still my setup seems to strange for them either lol
i think (if understand the readme correctly its exactly whats extnet is
doing) the best way would be simply allow to specify custom interface names.
that way we can build custom configs on our hosts how ever strange we want
right, that's the motivation behind that hook. Please try if oVirt can
do what you need, and report to this list!
Since you have todo it only for each physical host its not THAT evil todo
and you can write easy scripts todo that for you.
But what would be Handy in any case - no matter which setup or regular
Ovirt setup and iam really missing is a Firewall config.
Perfect dream would be something Visual with objects like Firewall Builder
(dev stopped sadly) , i think i saw something webbased in some opensource
firewall distros too.
I mean we have to config FIrewalls for the Hosts in anycase - of course i
know this would be a monster to implement fully
just dreaming :))
Well do not forget your dream, maybe someone would be able to implement
it one day (though it does not seem to be around the corner).