[Starlingx-discuss] How to access Virtualized central cloud from outside the Host
Hi,
I have installed the central cloud (All in one Duplex) in a virtualized environment. But not sure what NAT rules are required, to access it from outside the Host machine.
* Below is my deployment.
[Diagram Description automatically generated]
* Starlingx is installed.
system host-list +----+--------------+-------------+----------------+-------------+--------------+ | id | hostname | personality | administrative | operational | availability | +----+--------------+-------------+----------------+-------------+--------------+ | 1 | controller-0 | controller | unlocked | enabled | available | | 2 | controller-1 | controller | unlocked | enabled | available | +----+--------------+-------------+----------------+-------------+--------------+
* Packets are reaching to the Host machine listening on ens1, link-type EN10MB (Ethernet), capture size 262144 bytes 11:35:56.144807 IP 14.141.56.230.61002 > 172.31.21.86.8080: Flags [S], seq 1632511605, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0 11:35:56.145030 IP 14.141.56.230.48775 > 172.31.21.86.8080: Flags [S], seq 455906092, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0 11:35:56.396487 IP 14.141.56.230.57030 > 172.31.21.86.8080: Flags [S], seq 4106471277, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0 11:36:00.145533 IP 14.141.56.230.61002 > 172.31.21.86.8080: Flags [S], seq 1632511605, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
* I have tried below rules.
iptables -t nat -I PREROUTING -i ens1 -p tcp --dport 8080 -j DNAT --to-destination 10.10.10.2:8080
iptables -A FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -s 10.10.11.0/24 -o enp125s0 -j MASQUERADE
iptables -t nat -I POSTROUTING -s 10.10.10.0/24 -o ens1 -j MASQUERADE
* Ipv4 forwarding is enabled on the host and from Host I can reach the controllers.
But still could not see packet reaching to the controller. Any suggestion would be very helpful.
Thanks, Ankush
Usually you need a NAT rule from your host to the OAM IP.
For example a nat rule like this: host:1022 -> OAM-IP:22
From outside: ssh -p 1022 sysadmin@host
Andy ________________________________ From: Rai, Ankush Ankush.Rai@commscope.com Sent: Tuesday, March 30, 2021 11:27 PM To: starlingx-discuss@lists.starlingx.io starlingx-discuss@lists.starlingx.io Cc: Dharwadkar, Sriram Sriram.Dharwadkar@commscope.com; Sambandan, Devaraj Devaraj.Sambandan@commscope.com Subject: [Starlingx-discuss] How to access Virtualized central cloud from outside the Host
[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi,
I have installed the central cloud (All in one Duplex) in a virtualized environment. But not sure what NAT rules are required, to access it from outside the Host machine.
* Below is my deployment.
[Diagram Description automatically generated]
* Starlingx is installed.
system host-list
+----+--------------+-------------+----------------+-------------+--------------+
| id | hostname | personality | administrative | operational | availability |
+----+--------------+-------------+----------------+-------------+--------------+
| 1 | controller-0 | controller | unlocked | enabled | available |
| 2 | controller-1 | controller | unlocked | enabled | available |
+----+--------------+-------------+----------------+-------------+--------------+
* Packets are reaching to the Host machine
listening on ens1, link-type EN10MB (Ethernet), capture size 262144 bytes
11:35:56.144807 IP 14.141.56.230.61002 > 172.31.21.86.8080: Flags [S], seq 1632511605, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
11:35:56.145030 IP 14.141.56.230.48775 > 172.31.21.86.8080: Flags [S], seq 455906092, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
11:35:56.396487 IP 14.141.56.230.57030 > 172.31.21.86.8080: Flags [S], seq 4106471277, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
11:36:00.145533 IP 14.141.56.230.61002 > 172.31.21.86.8080: Flags [S], seq 1632511605, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
* I have tried below rules.
iptables -t nat -I PREROUTING -i ens1 -p tcp --dport 8080 -j DNAT --to-destination 10.10.10.2:8080
iptables -A FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -s 10.10.11.0/24 -o enp125s0 -j MASQUERADE
iptables -t nat -I POSTROUTING -s 10.10.10.0/24 -o ens1 -j MASQUERADE
* Ipv4 forwarding is enabled on the host and from Host I can reach the controllers.
But still could not see packet reaching to the controller. Any suggestion would be very helpful.
Thanks,
Ankush
participants (2)
-
Ning, Antai (Andy)
-
Rai, Ankush