Home / server / Questions / 592242
In Process
Zsub
Asked: 2014-05-01 02:52:31 +0800 CST

Why does installing vzctl on a fresh Centos6.5-minimal break network connectivity?

  • 772

I seem to have encountered a bug in vzctl's installation. Upon installing it in a clean CentOS6.5-minimal installation according to the official wiki, network connectivity is limited to pinging IP addresses (I suspect ICMP traffic only).

I have created a bugreport with steps to reproduce, also copied here:

  1. Install node with CentOS-6.5-x86_64-minimal.iso
  2. ifup eth0 and ping google.com to observe DNS resolution and network connectivity.
  3. Install wget (yum install wget).
  4. Follow steps on http://wiki.openvz.org/Quick_installation to install vzkernel, vzctl, vzquota, and ploop.
  5. reboot
  6. ifup eth0 and ping google.com to observe NO DNS resolution and network connectivity.
  7. Edit /etc/modprobe.d/openvz.conf to options nf_conntrack ip_conntrack_disable_ve0=0 and save.
  8. reboot
  9. ifup eth0 and ping google.com to observe DNS resolution and network connectivity.

Note that disabling iptables via service iptables stop restores connectivity, but that is a 'suboptimal' (hum hum :P ) workaround.

This is the output from iptables-save:

# iptables-save
# Generated by iptables-save v1.4.7 on Wed Apr 30 12:50:00 2014
*mangle
:PREROUTING ACCEPT [110:16800]
:INPUT ACCEPT [107:15810]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [35:4954]
:POSTROUTING ACCEPT [35:4954]
COMMIT
# Completed on Wed Apr 30 12:50:00 2014
# Generated by iptables-save v1.4.7 on Wed Apr 30 12:50:00 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [35:4954]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Apr 30 12:50:00 2014
networking

1 Answers

  1. the conntrack paramater fixed it for me, but since you already have maybe you forgot these settings

    /etc/sysctl.conf:

    net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 1
kernel.sysrq = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.conf.default.forwarding=1

    reload

    sysctl -p

    I also had to settup a bridge, not sure if that has anything to do with it, but worth looking into!

    • 2