On Tue, Jan 15, 2013 at 2:22 PM, Yaniv Kaul wrote: engine was configured asking to set up / override iptables, so I thought it had to be ok. ... oVirt Engine will be installed using the following configuration: ================================================================= override-httpd-config: yes http-port: 80 https-port: 443 host-fqdn: f18engine.Xxxxt auth-pass: ******** org-name: YYYYY default-dc-type: ISCSI db-remote-install: local db-local-pass: ******** nfs-mp: /ISO config-nfs: yes override-iptables: yes Proceed with the configuration listed above? (yes|no): yes ... Configuring Firewall (iptables)... [ DONE ] ... In engine setup log file: ... 2013-01-12 15:00:38::DEBUG::engine-setup::886::root:: configuring iptables 2013-01-12 15:00:38::DEBUG::engine-setup::917::root:: # Generated by ovirt-engine installer #filtering rules *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 111 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 892 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 892 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 875 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 875 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 662 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 662 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 2049 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 32803 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 32769 -j ACCEPT #drop all rule -A INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT 2013-01-12 15:00:38::DEBUG::common_utils::699::root:: successfully copied file /etc/ovirt-engine/iptables.example to target destination /etc/sysconfig/iptables 2013-01-12 15:00:38::DEBUG::common_utils::707::root:: setting file /etc/sysconfig/iptables uid/gid ownership 2013-01-12 15:00:38::DEBUG::common_utils::710::root:: setting file /etc/sysconfig/iptables mode to -1 2013-01-12 15:00:38::DEBUG::engine-setup::932::root:: Restarting the iptables service 2013-01-12 15:00:38::DEBUG::common_utils::1208::root:: stopping iptables 2013-01-12 15:00:38::DEBUG::common_utils::1245::root:: executing action iptables on service stop 2013-01-12 15:00:38::DEBUG::common_utils::427::root:: Executing command --> '/sbin/service iptables stop' 2013-01-12 15:00:38::DEBUG::common_utils::465::root:: output = 2013-01-12 15:00:38::DEBUG::common_utils::466::root:: stderr = Redirecting to /bin/systemctl stop iptables.service 2013-01-12 15:00:38::DEBUG::common_utils::467::root:: retcode = 0 2013-01-12 15:00:38::DEBUG::common_utils::1198::root:: starting iptables 2013-01-12 15:00:38::DEBUG::common_utils::1245::root:: executing action iptables on service start 2013-01-12 15:00:38::DEBUG::common_utils::427::root:: Executing command --> '/sbin/service iptables start' 2013-01-12 15:00:38::DEBUG::common_utils::465::root:: output = 2013-01-12 15:00:38::DEBUG::common_utils::466::root:: stderr = Redirecting to /bin/systemctl start iptables.service 2013-01-12 15:00:38::DEBUG::common_utils::467::root:: retcode = 0 2013-01-12 15:00:38::DEBUG::setup_sequences::59::root:: running _startEngine ... BTW: I have a similar problem with an all-in-one f18 + ovirt nightly setup running as a VM after engine-upgrade to 3.2.0-1.20130115.git2970f58 I'm not able to reach webadmin portal from the host but only if for example I run firefox from inside the engine itself exporting DISPAY env var. What would be the config expected for an f18 engine? In my case: 1) engine standalone as physical server It seems I have firewalld enabled iptables disabled ip6tables disabled ebtables ? but setup should have enabled it from the optionschosen.... but I don't see it in logfile, while I see 2013-01-12 15:00:38::DEBUG::engine-setup::1567::root:: using chkconfig to enable engine to load on system startup. 2013-01-12 15:00:38::DEBUG::common_utils::427::root:: Executing command --> '/sbin/chkconfig ovirt-engine on' 2013-01-12 15:00:38::DEBUG::common_utils::465::root:: output = 2013-01-12 15:00:38::DEBUG::common_utils::466::root:: stderr = Note: Forwarding request to 'systemctl enable ovirt-engine.service'. ln -s '/usr/lib/systemd/system/ovirt-engine.service' '/etc/systemd/system/multi-user.target.wants/ovirt-engine.service' So could it be a bug not enabling iptables during engine-setup??? At this moment my situation: # systemctl status firewalld.service firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) Active: active (running) since Tue, 2013-01-15 13:38:40 CET; 1h 17min ago Main PID: 469 (firewalld) CGroup: name=systemd:/system/firewalld.service └ 469 /usr/bin/python -Es /usr/sbin/firewalld --nofork Jan 15 13:38:40 f18engine systemd[1]: Started firewalld - dynamic firewall daemon. # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled) Active: inactive (dead) CGroup: name=systemd:/system/iptables.service # systemctl status ip6tables.service ip6tables.service - IPv6 firewall with ip6tables Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; disabled) Active: inactive (dead) CGroup: name=systemd:/system/ip6tables.service # systemctl status ebtables.service ebtables.service - SYSV: Ethernet Bridge filtering tables Loaded: loaded (/etc/rc.d/init.d/ebtables) Active: inactive (dead) CGroup: name=systemd:/system/ebtables.service # systemctl show ebtables.service| grep onflict Conflicts=shutdown.target ConflictedBy=firewalld.service so there is a problem between ebtables and firewalld (but perhaps this service has to run only on hypervisor and not engine?) 2) engine configured as an all-in-one in a vm [g.cecchi@f18aio ~]$ sudo systemctl status firewalld.service firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled) Active: inactive (dead) CGroup: name=systemd:/system/firewalld.service [g.cecchi@f18aio ~]$ sudo systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled) Active: active (exited) since Tue, 2013-01-15 14:42:46 CET; 18min ago Process: 31480 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS) Process: 31523 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/iptables.service Jan 15 14:42:46 f18aio.localdomain.local systemd[1]: Starting IPv4 firewall with iptables... Jan 15 14:42:46 f18aio.localdomain.local iptables.init[31523]: iptables: Applying firewall rules: WARNING: The state match is ob...tead. Jan 15 14:42:46 f18aio.localdomain.local iptables.init[31523]: [ OK ] Jan 15 14:42:46 f18aio.localdomain.local systemd[1]: Started IPv4 firewall with iptables. [g.cecchi@f18aio ~]$ sudo systemctl status ip6tables.service ip6tables.service - IPv6 firewall with ip6tables Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; disabled) Active: inactive (dead) CGroup: name=systemd:/system/ip6tables.service [g.cecchi@f18aio ~]$ sudo systemctl status ebtables.service ebtables.service - SYSV: Ethernet Bridge filtering tables Loaded: loaded (/etc/rc.d/init.d/ebtables) Active: inactive (dead) CGroup: name=systemd:/system/ebtables.service Gianluca

On Tue, Jan 15, 2013 at 4:16 PM, Gianluca Cecchi wrote: the not working file has this in its first line, I didn't notice before # oVirt default firewall configuration. Automatically generated by vdsm bootstrap script. my merged apparently working file here: https://docs.google.com/file/d/0BwoPbcrMv8mvYmJIU3oyeFlfZ3c/edit Gianluca