Description of problem:

during introspection virtualized node was able to get dhcp address but not able to get inspector.ipxe

 # iptables -n -v -L -t filter   was showing packet from on  ironic-inspector

I workarounded it with the following rule:

/etc/sysconfig/iptables:

...
:nova-api-OUTPUT - [0:0]
:nova-api-local - [0:0]
:nova-filter-top - [0:0]
-A INPUT -i br-ctlplane -p tcp -m tcp -j ACCEPT   <==============================
-A INPUT -i br-ctlplane -p udp -m udp --dport 67 -j ironic-inspector
-A INPUT -j nova-api-INPUT
-A INPUT -m comment --comment "000 accept related established rules" -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m comment --comment "001 accept all icmp" -m state --state NEW -j ACCEPT
-A INPUT -i lo -m comment --comment "002 accept all to lo interface" -m state --state NEW -j ACCEPT



Version-Release number of selected component (if applicable):
10

How reproducible:
always

Steps to Reproduce:
1. try to introspect a virtualized node with a virtualized undercloud
2.
3.

Actual results:
during the pxeboot process, node was able to get dhcp address with couldn't get the http://192.0.2.1:8088/inspetor.ipxe file


Expected results:
able to get the file

Additional info: