QA (public) » openQA Project (public)

okurz wrote:

• Did you try to reproduce with two manual VMs?
• So the VMs are running on 10.100.202.37 as well, right?

yes, as confirmed over chat.

• have you enabled NAT / IP Masquerade?

I could login to the machine (ssh root@…), masquerading is enabled according to grep 1 /proc/sys/net/ipv4/ip_forward

• Which firewall solution are you using?

Seems like no firewall in place. I could not find a firewall service running. Also, iptables-save does not show any output. I am not aware of setting up IP Masquerading without any firewall so I recommend you to enable one, e.g. firewalld, and setup NAT / IP Masquerade as described on http://open.qa/docs/#_multi_machine_tests_setup but adjusted for your interfaces on that server.

okurz wrote:

okurz wrote:

• Did you try to reproduce with two manual VMs?
• So the VMs are running on 10.100.202.37 as well, right?

yes, as confirmed over chat.

• have you enabled NAT / IP Masquerade?

I could login to the machine (ssh root@…), masquerading is enabled according to grep 1 /proc/sys/net/ipv4/ip_forward

• Which firewall solution are you using?

Seems like no firewall in place. I could not find a firewall service running. Also, iptables-save does not show any output. I am not aware of setting up IP Masquerading without any firewall so I recommend you to enable one, e.g. firewalld, and setup NAT / IP Masquerade as described on http://open.qa/docs/#_multi_machine_tests_setup but adjusted for your interfaces on that server.

Yes, I follow the Configure NAT with firewalld from http://open.qa/docs/#_multi_machine_tests_setup and adjust it, I re-enable the firewall service and run it again, it looks the problem show up too.
Thanks a lot.

Ok, I can see now that your brigde "br1" has the zone "internal" but no masquerading for internal is applied, e.g. see

# for i in external internal public trusted; do firewall-cmd --zone=$i --list-all; done
external (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: eth0 tun0
  sources: 
  services: ssh
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

internal (active)
  target: default
  icmp-block-inversion: no
  interfaces: br1
  sources: 
  services: ssh mdns samba-client dhcpv6-client
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

I know that the documentation in http://open.qa/docs/#_multi_machine_tests_setup mentions that but I am not sure how this is supposed to be working.

okurz wrote:

On your machine I enabled masquerading on the internal zone which you use with firewall-cmd --zone=internal --add-masquerade and retriggered the latest tests:
http://10.100.202.37/tests/461

The test is able to access the network correctly so I made the config permanent with firewall-cmd --runtime-to-permanent. Honestly I don't fully understand why that would be necessary but I will think about improving the documentation a bit in #52499 as well.

I guess with this we can close this ticket. Reopen if there are still open points to adress.

Hi Oliver,

Sorry for late, I spend some time to digest your comments.

I really appreciate for your great help.

Does it mean in my environment,

I need to set firewall-cmd --runtime-to-permanent --zone=internal --add-interface=br1 instead of firewall-cmd --permanent --zone=internal --add-interface=br1, and also set the internal masquerade as yes can be fixed the problem, am I correct ?

It would be also great if the documentation improving. :-)

Thanks a lot.

bchou wrote:

Does it mean in my environment,

I need to set firewall-cmd --runtime-to-permanent --zone=internal --add-interface=br1 instead of firewall-cmd --permanent --zone=internal --add-interface=br1

No. If you would try that then firewall-cmd should complain with "Can't use stand-alone options with other options.". The parameter --runtime-to-permanent is to be called on its own. firewalld has a transient state ("runtime") and the "permanent" state. When you want to apply changes to both you need to tell that to firewalld. There are multiple options, you can just change the runtime config and apply that to the permanent one or you set the permanent one and reload firewall rules or even reboot to apply the permanent state, e.g. the following are equivalent:

firewall-cmd --zone=internal --add-interface=br1
firewall-cmd --permanent --zone=internal --add-interface=br1

and

firewall-cmd --zone=internal --add-interface=br1
firewall-cmd --runtime-to-permanent

and

firewall-cmd --permanent --zone=internal --add-interface=br1
reboot

, and also set the internal masquerade as yes can be fixed the problem, am I correct ?

yes, this is how I fixed it.

It would be also great if the documentation improving. :-)

As soon as I understood on which zones the masquerading needs to be set we can improve that. So far unfortunately I am not feeling very confident myself though.

correct. https://github.com/os-autoinst/openQA/pull/2245 was created to update docs accordingly.

Great. :) Really appreciate for your helps.
I will keep following the ticket later.
Thank you.

okurz wrote:

correct. https://github.com/os-autoinst/openQA/pull/2245 was created to update docs accordingly.

Hello Oliver,

I just added the fips_setup into my test sequence,

I met another the resolve problem about
"can not resolve : scc.suse.com" and
"can not resolve : updates.suse.com"

the external interface has been set masquerade: yes , but I have no idea why..

On the other hand, the dist.suse.de can be resolved successfully.

I think the setting should be correct after configure via the new updated document.

# for i in external internal public trusted; do firewall-cmd --zone=$i --list-all; done

external (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: eth0 tun0
sources:
services: ssh
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:

internal (active)
target: default
icmp-block-inversion: no
interfaces: br1
sources:
services: ssh mdns samba-client dhcpv6-client
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:

Please refer to
http://10.100.202.37/tests/494#step/fips_setup/8

Thanks a lot.