Questions[nova-network](server)

I just configured my DevStack environment on a VM with IP 192.168.249.1. I would like that instance to generate VMs that are reachable within my private company network. Thus, I configured DevStack to generate IPs from them in the range:

FLOATING_RANGE=192.168.254.0/24

VMs are correctly created, and floating IPs are correctly assigned to them. I tried to create an instance in the admin project, and it was associated with the IP 192.168.254.1.

Then I modified the default security group, adding the following rules:

nova secgroup-add-rule default tcp 22 22 0.0.0.0/0
nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0

Now I can ping and access via SSH the VMs, from the DevStack host (192.168.249.1). The VMs are correctly configured:

$ nova show hello
+--------------------------------------+----------------------------------------------------------------+
| Property                             | Value                                                              |
+--------------------------------------+----------------------------------------------------------------+
| OS-DCF:diskConfig                    | AUTO                                                               |
| OS-EXT-AZ:availability_zone          | nova                                                           |
| OS-EXT-STS:power_state               | 1                                                              |
| OS-EXT-STS:task_state                | -                                                              |
| OS-EXT-STS:vm_state                  | active                                                         |
| OS-SRV-USG:launched_at               | 2016-07-27T11:53:40.000000                                     |
| OS-SRV-USG:terminated_at             | -                                                              |
| accessIPv4                           |                                                                |
| accessIPv6                           |                                                                |
| config_drive                         | True                                                           |
| created                              | 2016-07-27T11:53:17Z                                           |
| description                          | hello                                                          |
| flavor                               | m1.tiny (1)                                                    |
| hostId                               | 76e96a3eec1a4472c12b7d4b1ce11737420b17a0480d760f77ab7b5a       |
| id                                   | 189b2423-5b11-4f6d-bfe5-ff03649a1b74                           |
| image                                | cirros-0.3.4-x86_64-uec (63025b58-4c4f-4352-aeb7-378f62e6bccc) |
| key_name                             | -                                                              |
| locked                               | False                                                          |
| metadata                             | {}                                                             |
| name                                 | hello                                                          |
| os-extended-volumes:volumes_attached | []                                                             |
| private network                      | 10.0.0.2, 192.168.254.1                                        |
| progress                             | 0                                                              |
| security_groups                      | default                                                        |
| status                               | ACTIVE                                                         |
| tags                                 | []                                                             |
| tenant_id                            | 36a66b65bd094a538370f4a1e3d8d3e6                               |
| updated                              | 2016-07-27T11:53:40Z                                           |
| user_id                              | 554fcfc91ba34ca2b1262338a9f93fe9                               |
+--------------------------------------+----------------------------------------------------------------+

As you can see, the VM is associated with two IPs (a fixed, and a floating, and the floating is, as I mentioned above, well-formed and "pingable" from the DevStack host).

However, I am trying now to ping the VM from my computer (IP: 192.168.252.146), but I cannot reach it (neither via SSH or ping). However, the VM can ping 8.8.8.8.

Any idea on why is this happening, or how I can check what is wrong?

Thanks.

If it is needed, this is the list of active services:

+----+------------------+---------------+----------+---------+-------+----------------------------+-----------------+
| Id | Binary           | Host          | Zone     | Status  | State | Updated_at                 | Disabled Reason |
+----+------------------+---------------+----------+---------+-------+----------------------------+-----------------+
| 3  | nova-conductor   | pc            | internal | enabled | up    | 2016-07-28T12:30:44.000000 | -               |
| 5  | nova-network     | pc            | internal | enabled | up    | 2016-07-27T13:41:46.000000 | -               |
| 6  | nova-scheduler   | pc            | internal | enabled | up    | 2016-07-28T12:30:43.000000 | -               |
| 7  | nova-consoleauth | pc            | internal | enabled | up    | 2016-07-28T12:30:47.000000 | -               |
| 8  | nova-compute     | pc            | nova     | enabled | up    | 2016-07-28T12:30:49.000000 | -               |
+----+------------------+---------------+----------+---------+-------+----------------------------+-----------------+

This is less of an OpenStack question and more of an iptables question. Consider the following chain in the NAT table

Chain nova-network-POSTROUTING (1 references)
pkts bytes target     prot opt in     out     source               destination         
0     0 ACCEPT     all  --  any    any     172.16.100.0/24      10.128.0.223        
0     0 ACCEPT     all  --  any    any     172.16.100.0/24      172.16.100.0/24      ! ctstate DNAT
0     0 SNAT       all  --  any    any     172.16.100.6         anywhere             ctstate DNAT to:10.128.0.161

Can anyone tell me what 1) the "! ctstate DNAT" means in the second rule and 2) the "ctstate DNAT to:10.128.0.161" means in the 3rd rule

Thanks

I get this error when I try to start the machine. There are free IP addresses (both floating and fixed). I tried to look about it on the web, but no luck (there is an answer somewhere which doesnt solve my problem).

Here the entire traceback: http://pastebin.com/vB0gm1GH

Thank you.