Bug 1056091
Summary: | Query of iptables after Floating IP creation takes 20+ second to return. | ||
---|---|---|---|
Product: | Red Hat OpenStack | Reporter: | Joe Talerico <jtaleric> |
Component: | openstack-neutron | Assignee: | Miguel Angel Ajo <mangelajo> |
Status: | CLOSED NOTABUG | QA Contact: | Ofer Blaut <oblaut> |
Severity: | unspecified | Docs Contact: | |
Priority: | high | ||
Version: | 4.0 | CC: | chrisw, jtaleric, lpeer, majopela, nyechiel, perfbz, yeylon |
Target Milestone: | --- | ||
Target Release: | 5.0 (RHEL 7) | ||
Hardware: | x86_64 | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2014-06-05 16:49:08 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Joe Talerico
2014-01-21 14:17:09 UTC
please try: # iptables -L -t nat -n I think it's probably related to name resolution, while iptables tries to do inverse resolution of IPs on the lists. I tried to reproduce it here, but didn't work. I really suspect is the DNS issue, I checked that I have a DNS server, and that it's accessible from the namespace. [root@rhos4-rhel65 ~]# time ip netns exec qrouter-fcf103bf-40e7-49a4-a2c3-f03fd589094c iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination neutron-l3-agent-PREROUTING all -- anywhere anywhere Chain POSTROUTING (policy ACCEPT) target prot opt source destination neutron-l3-agent-POSTROUTING all -- anywhere anywhere neutron-postrouting-bottom all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination neutron-l3-agent-OUTPUT all -- anywhere anywhere Chain neutron-l3-agent-OUTPUT (1 references) target prot opt source destination DNAT all -- anywhere 172.24.4.228 to:192.168.100.2 Chain neutron-l3-agent-POSTROUTING (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ! ctstate DNAT Chain neutron-l3-agent-PREROUTING (1 references) target prot opt source destination REDIRECT tcp -- anywhere 169.254.169.254 tcp dpt:http redir ports 9697 DNAT all -- anywhere 172.24.4.228 to:192.168.100.2 Chain neutron-l3-agent-float-snat (1 references) target prot opt source destination SNAT all -- 192.168.100.2 anywhere to:172.24.4.228 Chain neutron-l3-agent-snat (1 references) target prot opt source destination neutron-l3-agent-float-snat all -- anywhere anywhere SNAT all -- 192.168.100.0/24 anywhere to:172.24.4.227 Chain neutron-postrouting-bottom (1 references) target prot opt source destination neutron-l3-agent-snat all -- anywhere anywhere real 0m0.025s user 0m0.000s sys 0m0.008s [root@rhos4-rhel65 ~]# ip netns exec qrouter-fcf103bf-40e7-49a4-a2c3-f03fd589094c cat /etc/resolv.conf ; generated by /sbin/dhclient-script search int_connected nameserver 192.168.50.1 [root@rhos4-rhel65 ~]# ip netns exec qrouter-fcf103bf-40e7-49a4-a2c3-f03fd589094c ping www.google.com PING www.google.com (173.194.70.103) 56(84) bytes of data. 64 bytes from fa-in-f103.1e100.net (173.194.70.103): icmp_seq=1 ttl=43 time=49.2 ms Setting a wrong nameserver it reproduces, so it probably was that. [root@rhos4-rhel65 ~]# ip netns exec qrouter-fcf103bf-40e7-49a4-a2c3-f03fd589094c echo nameserver 192.168.50.166 > /etc/resolv.conf [root@rhos4-rhel65 ~]# time ip netns exec qrouter-fcf103bf-40e7-49a4-a2c3-f03fd589094c iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination neutron-l3-agent-PREROUTING all -- anywhere anywhere Chain POSTROUTING (policy ACCEPT) target prot opt source destination neutron-l3-agent-POSTROUTING all -- anywhere anywhere neutron-postrouting-bottom all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination neutron-l3-agent-OUTPUT all -- anywhere anywhere Chain neutron-l3-agent-OUTPUT (1 references) target prot opt source destination DNAT all -- anywhere 172.24.4.228 to:192.168.100.2 Chain neutron-l3-agent-POSTROUTING (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ! ctstate DNAT Chain neutron-l3-agent-PREROUTING (1 references) target prot opt source destination REDIRECT tcp -- anywhere 169.254.169.254 tcp dpt:http redir ports 9697 DNAT all -- anywhere 172.24.4.228 to:192.168.100.2 Chain neutron-l3-agent-float-snat (1 references) target prot opt source destination SNAT all -- 192.168.100.2 anywhere to:172.24.4.228 Chain neutron-l3-agent-snat (1 references) target prot opt source destination neutron-l3-agent-float-snat all -- anywhere anywhere SNAT all -- 192.168.100.0/24 anywhere to:172.24.4.227 Chain neutron-postrouting-bottom (1 references) target prot opt source destination neutron-l3-agent-snat all -- anywhere anywhere real 0m50.122s user 0m0.005s sys 0m0.042s |