Description of problem: Post Nova (Neutron) deploy, the puppet module will execute successfully, however after an instance is created on the next puppet run the firewall module will complain because openvswitch has created some new rules: Puppet Output: Error: Could not prefetch firewall provider 'iptables': Invalid address from IPAddr.new: FA:16:3E:53:D1:11 Error: /Firewall[001 nova compute incoming]: Could not evaluate: Invalid address from IPAddr.new: FA:16:3E:53:D1:11 Error: /Firewall[001 RPC and gluster daemon incoming UDP]: Could not evaluate: Invalid address from IPAddr.new: FA:16:3E:53:D1:11 Error: /Firewall[001 RPC and gluster daemon incoming]: Could not evaluate: Invalid address from IPAddr.new: FA:16:3E:53:D1:11 Error: /Firewall[002 gluster bricks incoming]: Could not evaluate: Invalid address from IPAddr.new: FA:16:3E:53:D1:11 Error: /Firewall[002 vxlan udp]: Could not evaluate: Invalid address from IPAddr.new: FA:16:3E:53:D1:11 iptables snippet: Chain neutron-openvswi-s2c31f940-7 (1 references) num target prot opt source destination 1 RETURN all -- 10.0.0.25 0.0.0.0/0 MAC FA:16:3E:53:D1:11 2 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain neutron-openvswi-sead94d3e-8 (1 references) num target prot opt source destination 1 RETURN all -- 10.0.0.26 0.0.0.0/0 MAC FA:16:3E:91:A9:77 2 DROP all -- 0.0.0.0/0 0.0.0.0/0 Version-Release number of selected component (if applicable): icehouse-3 How reproducible: Always Steps to Reproduce: 1. Deploy Nova (Neutron) 2. Create a new instance 3. Run puppet agent -tv Actual results: firewall provider will error Expected results: no error Additional info:
This also occurs with OpenStack Havana.
This is the upstream pull request to fix this problem - https://github.com/puppetlabs/puppetlabs-firewall/pull/337 Still a work in progress, but looks close to being done. I'll help out upstream however I can to speed it along.
same problem on icehouse
just ran into this also after I updated the masquerade rule to use br-ex instead of eth0
Is it still a open bug? I am seeing this issue on our production openstack instance. Willing to help in case you need access to box. Regards, Nilesh
This is still waiting to be merged upstream, at which point the next rebase of the firewall module will pull it into RDO. Alternatively we can carry the patch ourselves but I'd rather just get it upstreamed. I have offered virtual cookies in the pull request as incentive to try and move it along.
https://github.com/puppetlabs/puppetlabs-firewall/pull/337 was merged on July 26, 2014, and the fix is included in the RDO Icehouse (and later) packages.