[Users] SPICE behind NAT

[Alan Murrell]

Just got a chance to get back to this.  Looks like I cannot connect  
using SPICE at all, even from the internal network.  I could connect  
fine (from internal network) before the attempted proxy changes :-(

When I try to connect using SPICE, the black console windows pops ups,  
and just says "Connecting to graphic server", then just stays there.   
I can connect using VNC, if that helps shed any light.

To answer Andrew's questions:

Quoting "Andrew Lau" <andrew at andrewklau.com>:

> - Can you connect to squid from your browser?

If I go to <http://vm-mgmt01.localdomain:3128> in my browser I get:

--- START ---

ERROR
The requested URL could not be retrieved

The following error was encountered while trying to retrieve the URL: /

     Invalid URL

Some aspect of the requested URL is incorrect.

Some possible problems are:

     Missing or incorrect access protocol (should be "http://" or similar)

     Missing hostname

     Illegal double-escape in the URL-Path

     Illegal character in hostname; underscores are not allowed.

Your cache administrator is root.
--- END ---

> - Did you modify the squid.conf to match your setup? (dst addresses, etc).

I have the following for my SPICE config:

--- START ---
# SPICE proxy
http_access deny CONNECT !Safe_ports
acl spice_servers dst 10.20.37.0/24
http_access allow spice_servers
--- END ---

<10.20.37.0/24> is my internal network.

> - iptables?

I made the suggested ACCEPT entry, but just to be sure, I completely  
stopped iptables so the server was wide-open and still unable to  
connect to SPICE.  Still get same error when trying to connect to to  
the proxy.

> - restarted engine?

I did.  I also tried the following (restarted engine and tested after  
each attempt):

   - engine-config -s SpiceProxyDefault=  (i.e., set it back to blank,  
and also stopped Squid)
   - engine-config -s SpiceProxyDefault="http://10.20.37.104:3128"  
(the internal IP of my ovirt-engine/all-in-one server.  I also had  
Squid started for this test)

The results were the same: SPICE console just stuck on "Connecting to  
graphic server"

I think I really bollocks'd this one up and may need to do a fresh  
install and try again.

> - If you're using ovirt 3.4 make sure you set the cluster policy too

Using 3.3 from Yum repository.

-Alan