Unable to use SSVM Or CPVM on 4.18/4.19

[tamoorahmedntu]

ISSUE TYPE

• Other

COMPONENT NAME

SSVM
CPVM

CLOUDSTACK VERSION

CloudStack 4.19.1.0 

CONFIGURATION

Advance Networking
Security Group 

OS / ENVIRONMENT

Ubuntu 22.04
KVM

1. Managment 
2. Host M
3. Host S
4. Storage Server NFS

SUMMARY

SSVM and CPVM doesn't show screen or website all unable to do anything when VM is up  unless I ssh to CPVM then run command to open all ports on iptables but this doesnt work on SSVM 

STEPS TO REPRODUCE

Setup New Advance Networking with new Zone on Ubuntu 22.04 Using KVM 

EXPECTED RESULTS

SSVM accessible all from Any IP ports 443 
CPVM accessible all from Any IP ports 443 

ACTUAL RESULTS

SSVM Not accessible from Any IP ports 443 or Any Other except SSH 169
CPVM Not accessible from Any IP ports 443 or Any Other except SSH 169
CPVM allow all in iptables (ssh first then apply all ports allow iptables ) can access console screen 

Logs attached Below:

management-server.log
agent.log

network:
  version: 2
  ethernets:
    ens160:
      dhcp4: false
    ens33:
      dhcp4: false
  bridges:
   cloudbr0:
    addresses: [0.0.168.2/23]
    routes:
     - to: default
       via: 0.0.168.254
    nameservers:
     addresses: [8.8.8.8]
    interfaces: [ens160]
    dhcp4: false
    dhcp6: false
    parameters:
       stp: false
       forward-delay: 0
   cloudbr1:
    dhcp4: false
    interfaces: [ens33]
    parameters:
       stp: false

[rajujith]

@tamoorahmedntu I am not sure whether I understood the issue you are facing but I believe you may be able to report the issue better after going through this document: https://docs.cloudstack.apache.org/en/latest/adminguide/systemvm.html#accessing-system-vms.

[tamoorahmedntu]

The issue I'm facing is the Web console to CPVM is only accessible once I ssh into it and tell iptables to allow all ports. I'm sure this is not correct I should not be sshing into the vm and allowing all ports in order for the console to work.

[weizhouapache]

The issue I'm facing is the Web console to CPVM is only accessible once I ssh into it and tell iptables to allow all ports. I'm sure this is not correct I should not be sshing into the vm and allowing all ports in order for the console to work.
…
________________________________ From: Jithin Raju @.> Sent: Tuesday, August 6, 2024 5:16:24 AM To: apache/cloudstack @.> Cc: Ahmed, Tamoor @.>; Mention @.> Subject: Re: [apache/cloudstack] Unable to use SSVM Or CPVM on 4.18/4.19 (Issue #9490) @tamoorahmedntuhttps://github.com/tamoorahmedntu I am not sure whether I understood the issue you are facing but I believe you may be able to report the issue better after going through this document: https://docs.cloudstack.apache.org/en/latest/adminguide/systemvm.html#accessing-system-vms. — Reply to this email directly, view it on GitHub<#9490 (comment)>, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ANH2J2QVU6JHBD5NUH3HWMTZQBEZRAVCNFSM6AAAAABMBE3ACGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZQGM2DQNBRGM. You are receiving this because you were mentioned.Message ID: @.***> DISCLAIMER: This email is intended solely for the addressee. It may contain private and confidential information. If you are not the intended addressee, please take no action based on it nor show a copy to anyone. In this case, please reply to this email to highlight the error. Opinions and information in this email that do not relate to the official business of Nottingham Trent University shall be understood as neither given nor endorsed by the University. Nottingham Trent University has taken steps to ensure that this email and any attachments are virus-free, but we do advise that the recipient should check that the email and its attachments are actually virus free. This is in keeping with good computing practice.

@tamoorahmedntu
can you share the output of some commands inside CPVM ?

• iptables-save
• ip a
• ip route

[tamoorahmedntu]

Unfortunately I'm unable to that until I solve another issue #9489

[tamoorahmedntu]

root@v-3-VM:~# iptables-save
# Generated by iptables-save v1.8.7 on Fri Aug  9 18:12:41 2024
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [6571:370457]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 13 -j DROP
-A INPUT -p icmp -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 3922 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8001 -j ACCEPT
-A INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 8001 -j ACCEPT
-A INPUT -i eth2 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth2 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth2 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
COMMIT
# Completed on Fri Aug  9 18:12:41 2024
# Generated by iptables-save v1.8.7 on Fri Aug  9 18:12:41 2024
*nat
:PREROUTING ACCEPT [8:528]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [18:1239]
:POSTROUTING ACCEPT [18:1239]
COMMIT
# Completed on Fri Aug  9 18:12:41 2024

root@v-3-VM:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 0e:00:a9:fe:00:15 brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    altname ens3
    inet 169.254.0.21/16 brd 169.254.255.255 scope global eth0
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 1e:00:27:00:00:26 brd ff:ff:ff:ff:ff:ff
    altname enp0s4
    altname ens4
    inet 152.71.168.16/24 brd 152.71.168.255 scope global eth1
       valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 1e:00:58:00:00:01 brd ff:ff:ff:ff:ff:ff
    altname enp0s5
    altname ens5
    inet 152.71.168.20/24 brd 152.71.168.255 scope global eth2
       valid_lft forever preferred_lft forever

root@v-3-VM:~# ip route
default via 152.71.168.254 dev eth2 
8.8.8.8 via 152.71.168.254 dev eth1 
10.0.0.0/8 via 152.71.168.254 dev eth1 
152.71.168.0/24 dev eth1 proto kernel scope link src 152.71.168.16 
152.71.168.0/24 dev eth2 proto kernel scope link src 152.71.168.20 
169.254.0.0/16 dev eth0 proto kernel scope link src 169.254.0.21 
172.16.0.0/12 via 152.71.168.254 dev eth1 
192.168.0.0/16 via 152.71.168.254 dev eth1 
root@v-3-VM:~# 

[rajujith]

@tamoorahmedntu I suspect the issue is possibly caused by the same subnet in the management/pod and public traffic. Is it possible to use two different subnets for them?

[github-actions]

This issue is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.