9:38 p.m.
High level network advice request :)
I have a self-hosted engine deployed on a node, Ovirt v. 4.3. I am testing, but I
don't understand the big idea of how to set-up Ovirt networking for hosted /
engine-managed virtual servers. I would like to host a few virtual servers for things like
Next/OwnCloud, SuiteCRM, NethServer or others.
For example, I know exactly how set-up a virtual machine with a centos / lamp stack on a
fedora host, I can make a network bridge for the vm with fedora cli, then use haproxy (or
squid) as a reverse-redirect server to allow WAN access to the vm server using FQDNs.
What is a good strategy for Ovirt hosting a webserver? To use the default ovirt management
network for the virtual server machines doesn't seem like a best practice?
Should I make a new logical network for the virtual servers? Do I need to configure
bridges for the machines? It looks like bridges and virtual NICs are automatically
configured when I make the network and virtual machines, is that right?
Is it the usual or typical practice that one ovirt logical network uses only one network
bridge to a one physical NIC? Would all of the kVMs on the logical network share the same
/ single bridge of the particular network? I'm not sure what the big idea should be,
what is a best practice?
I wonder, should I bond several physical NICs, then point the bridge, for a new /
dedicated logical network for webservers, to the the bonded NICs? There is more than a
little new vocabulary for me to onboard for Ovirt / virtual / logical networks...I will
greatly appreciate, and I thank you in advance for any top level / best practice advice!
9:49 p.m.
This is really a situational question.
Short answer is - there's no problem running everything on ovirtmgmt
network - I do it, especially if what your deploying on is essentially
one big network. Its just the VM's bridged into your hosts NIC.
The long answer is, you can create many networks based on a number of
factors i.e. VLAN tagging, different names for different groups,
different things to run over different networks (like migration traffic
and/or host storage traffic etc) this gives you flexibility in the long
run if you need to change things around - more management overhead but
more flexibility.
My home server - being a single node home server - uses a Bond0
interface that the ovirtmgmt bridge is created on. I also have a VLAN
Tagged network on that bond setup in oVirt to some servers, as I run my
server and client device (and IoT device) networks separately.
In terms of your webserver example - you'd ideally have a webproxy VM
that you forward your 80,443 to from your router, and it'd be setup to
talk to any other application/VM internally on their internal IPs - I do
this for a self hosted Nextcloud, Cacti/NMS, Plex, some development
servers etc all behind my NAT router, all on oVirt.
If you have any specific questions or problems - please let me know and
I'll try my best to help.
On 24/1/20 2:38 pm, Richard Nilsson wrote:
High level network advice request :)
I have a self-hosted engine deployed on a node, Ovirt v. 4.3. I am testing, but I
don't understand the big idea of how to set-up Ovirt networking for hosted /
engine-managed virtual servers. I would like to host a few virtual servers for things like
Next/OwnCloud, SuiteCRM, NethServer or others.
For example, I know exactly how set-up a virtual machine with a centos / lamp stack on a
fedora host, I can make a network bridge for the vm with fedora cli, then use haproxy (or
squid) as a reverse-redirect server to allow WAN access to the vm server using FQDNs.
What is a good strategy for Ovirt hosting a webserver? To use the default ovirt
management network for the virtual server machines doesn't seem like a best practice?
Should I make a new logical network for the virtual servers? Do I need to configure
bridges for the machines? It looks like bridges and virtual NICs are automatically
configured when I make the network and virtual machines, is that right?
Is it the usual or typical practice that one ovirt logical network uses only one network
bridge to a one physical NIC? Would all of the kVMs on the logical network share the same
/ single bridge of the particular network? I'm not sure what the big idea should be,
what is a best practice?
I wonder, should I bond several physical NICs, then point the bridge, for a new /
dedicated logical network for webservers, to the the bonded NICs? There is more than a
little new vocabulary for me to onboard for Ovirt / virtual / logical networks...I will
greatly appreciate, and I thank you in advance for any top level / best practice advice!
_______________________________________________
Users mailing list -- users(a)ovirt.org
To unsubscribe send an email to users-leave(a)ovirt.org
Privacy Statement: https://www.ovirt.org/site/privacy-policy/
oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/H7GUEYSB77C...
6:18 a.m.
As Joseph mentioned in his email, it is mostly situational dependent.
I run a 2 node cluster and use multiple interfaces.
The first 1Gb nic is for ovirtmgmt and is used for management with no vlan tagging and has
the default gateway, DNS, etc assigned to it.
My 2nd 1Gb NIC, for now, is for all VM traffic and from the switch is setup as a trunk and
carries multiple vlans to the various VM's.
My 3rd NIC is 10Gb and it is on its own isolated vlan with no routing and I use it for
connectivity to my back end NFS storage and I made it the interface for VM migration
between nodes.
An additional 10Gb nic is not in use right now, but plans are that once I can get a
switch with more 10Gb connectivity, that will become my interface for all VM traffic.
So as you can see, very situational dependent.
As Joseph also mentioned, please feel free to ask if you have any questions. I am still
pretty new to oVirt, but making progress.
Robert
-----Original Message-----
From: Richard Nilsson <rnilsson(a)rcn.com>
Sent: Thursday, January 23, 2020 10:39 PM
To: users(a)ovirt.org
Subject: [ovirt-users] High level network advice request
High level network advice request :)
I have a self-hosted engine deployed on a node, Ovirt v. 4.3. I am testing, but
I don't understand the big idea of how to set-up Ovirt networking for hosted
/ engine-managed virtual servers. I would like to host a few virtual servers
for things like Next/OwnCloud, SuiteCRM, NethServer or others.
For example, I know exactly how set-up a virtual machine with a centos /
lamp stack on a fedora host, I can make a network bridge for the vm with
fedora cli, then use haproxy (or squid) as a reverse-redirect server to allow
WAN access to the vm server using FQDNs.
What is a good strategy for Ovirt hosting a webserver? To use the default
ovirt management network for the virtual server machines doesn't seem like
a best practice?
Should I make a new logical network for the virtual servers? Do I need to
configure bridges for the machines? It looks like bridges and virtual NICs are
automatically configured when I make the network and virtual machines, is
that right?
Is it the usual or typical practice that one ovirt logical network uses only one
network bridge to a one physical NIC? Would all of the kVMs on the logical
network share the same / single bridge of the particular network? I'm not
sure what the big idea should be, what is a best practice?
I wonder, should I bond several physical NICs, then point the bridge, for a
new / dedicated logical network for webservers, to the the bonded NICs?
There is more than a little new vocabulary for me to onboard for Ovirt /
virtual / logical networks...I will greatly appreciate, and I thank you in advance
for any top level / best practice advice!
_______________________________________________
Users mailing list -- users(a)ovirt.org
To unsubscribe send an email to users-leave(a)ovirt.org Privacy Statement:
https://www.ovirt.org/site/privacy-policy/
oVirt Code of Conduct:
https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/H7GUEYSB77C
B72Q3HR3GOTXHQPAEFD6A/
7:49 a.m.
Thanks again Joseph,
I do have specific noob question. I'm learning so much with this test deployment :)
'Amazing.
I can't get to a test vm / webserver managed by Ovirt Engine from WAN, as I do with
the Engine and other machines....I suspect that I am missing some pretty basic setup step
with security but I don't know what to check next?
So I use pfSense with haproxy add on, which is pretty great. Squid might be better, but
haproxy was really easy for me to set-up without mastering config syntax...
My pfSense is on a physical box at the gateway as a gateway server....so not a vm.
I have a working vm on an ovirt node manged / created with engine. I set up the vm with
fedora 31 server then added a lamp stack with mariadb & etc.
I can access (from LAN only, not from WAN) the server test page and a text php info page
that I made. I don't know what to adjust to debug the problem. I suspect security /
firewall issues but not with the pfSense / haproxy reverse redirect, I think that's
all fine. I use pfSense DNS Resolution in the LAN as split DNS. Other machines,
including the hosted engine machine are accessible from WAN using URLs / FQDNs.
My engine for testing is engine.metrodesignoffice.com
The test server is mdowebserver.metrodesignoffice.com
What should I look at next? I only installed one node so I can't sync new logical
networks or vnet profiles as I understand (the single node can't be placed in
maintenance mode, for obvious reasons?).
8:02 a.m.
Given what you have described, it seems to be either a HAproxy or server config issue. If
the server can reach the internet, that solves default gateway issues, if you can reach
the server from the LAN then that solves any networking issues.
I would probably do a packet capture at the pfSense box and on the server to see where
they stop. It can also tell you if there may be some kind of haproxy issue where the
translation may not be what you expect.
Robert
________________________________________
From: Richard Nilsson <rnilsson(a)rcn.com>
Sent: Friday, January 31, 2020 8:49 AM
To: users(a)ovirt.org
Subject: [ovirt-users] Re: High level network advice request
Thanks again Joseph,
I do have specific noob question. I'm learning so much with this test deployment :)
'Amazing.
I can't get to a test vm / webserver managed by Ovirt Engine from WAN, as I do with
the Engine and other machines....I suspect that I am missing some pretty basic setup step
with security but I don't know what to check next?
So I use pfSense with haproxy add on, which is pretty great. Squid might be better, but
haproxy was really easy for me to set-up without mastering config syntax...
My pfSense is on a physical box at the gateway as a gateway server....so not a vm.
I have a working vm on an ovirt node manged / created with engine. I set up the vm with
fedora 31 server then added a lamp stack with mariadb & etc.
I can access (from LAN only, not from WAN) the server test page and a text php info page
that I made. I don't know what to adjust to debug the problem. I suspect security /
firewall issues but not with the pfSense / haproxy reverse redirect, I think that's
all fine. I use pfSense DNS Resolution in the LAN as split DNS. Other machines,
including the hosted engine machine are accessible from WAN using URLs / FQDNs.
My engine for testing is engine.metrodesignoffice.com
The test server is mdowebserver.metrodesignoffice.com
What should I look at next? I only installed one node so I can't sync new logical
networks or vnet profiles as I understand (the single node can't be placed in
maintenance mode, for obvious reasons?).
_______________________________________________
Users mailing list -- users(a)ovirt.org
To unsubscribe send an email to users-leave(a)ovirt.org
Privacy Statement: https://www.ovirt.org/site/privacy-policy/
oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/Q2WNHYIUWVL...
1549
days inactive
1556
days old
4 comments
3 participants
participants (3)
-
Joseph Goldman -
Richard Nilsson -
Robert Webb