self.destroy() called from reboot() deletes iptables rule of this instance. But reboot() function does not re-create iptables rule for this instance.
That is why iptables rules are disappeared when instance is rebooted.
Here are output of iptables-save before and after euca-reboot-instance.
root@usv401:/opt/openstack# euca-run-instances -g secgrp1 -k test -t m1.tiny ami-tiny
RESERVATION r-8xkekwbe admin secgrp1
INSTANCE i-00000001 ami-tiny scheduling test (admin, None) 0 m1.tiny 2011-02-24T07:04:48Z unknown zone
root@usv401:/opt/openstack# euca-describe-instances
RESERVATION r-8xkekwbe admin secgrp1
INSTANCE i-00000001 ami-tiny 10.0.0.3 10.0.0.3 running test (admin, usv401) 0 m1.tiny 2011-02-24T07:04:48Z nova
root@usv401:/opt/openstack# iptables-save
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:06:42 2011
*nat
:PREROUTING ACCEPT [4:939]
:POSTROUTING ACCEPT [25:1500]
:OUTPUT ACCEPT [27:2186]
:SNATTING - [0:0]
-A PREROUTING -d 192.168.6.41/32 -p udp -m udp --dport 2000 -j DNAT --to-destination 10.0.0.2:1194
-A PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.6.41:8773
-A POSTROUTING -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
-A POSTROUTING -s 10.0.0.0/8 -d 10.128.0.0/24 -j ACCEPT
-A POSTROUTING -j SNATTING
-A SNATTING -s 10.0.0.0/8 -j SNAT --to-source 192.168.6.41
COMMIT
# Completed on Thu Feb 24 16:06:42 2011
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:06:42 2011
*filter
:INPUT ACCEPT [28696:167045505]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [28707:167053799]
:nova-fallback - [0:0]
:nova-inst-1 - [0:0]
:nova-local - [0:0]
:nova-sg-2 - [0:0]
-A FORWARD -j nova-local
-A FORWARD -o br100 -j ACCEPT
-A FORWARD -i br100 -j ACCEPT
-A FORWARD -d 10.0.0.2/32 -p udp -m udp --dport 1194 -j ACCEPT
-A OUTPUT -j nova-local
-A nova-fallback -j DROP
-A nova-inst-1 -m state --state INVALID -j DROP
-A nova-inst-1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A nova-inst-1 -j nova-sg-2
-A nova-inst-1 -s 10.0.0.1/32 -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A nova-inst-1 -s 10.0.0.0/27 -j ACCEPT
-A nova-inst-1 -j nova-fallback
-A nova-local -d 10.0.0.3/32 -j nova-inst-1
COMMIT
# Completed on Thu Feb 24 16:06:42 2011
root@usv401:/opt/openstack# euca-reboot-instances i-00000001
INSTANCE i-00000001
root@usv401:/opt/openstack# euca-describe-instances
RESERVATION r-8xkekwbe admin secgrp1
INSTANCE i-00000001 ami-tiny 10.0.0.3 10.0.0.3 running test (admin, usv401) 0 m1.tiny 2011-02-24T07:04:48Z nova
root@usv401:/opt/openstack# iptables-save
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:08:04 2011
*nat
:PREROUTING ACCEPT [5:1247]
:POSTROUTING ACCEPT [30:1800]
:OUTPUT ACCEPT [33:2829]
:SNATTING - [0:0]
-A PREROUTING -d 192.168.6.41/32 -p udp -m udp --dport 2000 -j DNAT --to-destination 10.0.0.2:1194
-A PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.6.41:8773
-A POSTROUTING -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
-A POSTROUTING -s 10.0.0.0/8 -d 10.128.0.0/24 -j ACCEPT
-A POSTROUTING -j SNATTING
-A SNATTING -s 10.0.0.0/8 -j SNAT --to-source 192.168.6.41
COMMIT
# Completed on Thu Feb 24 16:08:04 2011
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:08:04 2011
*filter
:INPUT ACCEPT [7621:502667]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7638:507563]
:nova-fallback - [0:0]
:nova-local - [0:0]
-A FORWARD -j nova-local
-A FORWARD -o br100 -j ACCEPT
-A FORWARD -i br100 -j ACCEPT
-A FORWARD -d 10.0.0.2/32 -p udp -m udp --dport 1194 -j ACCEPT
-A OUTPUT -j nova-local
-A nova-fallback -j DROP
COMMIT
# Completed on Thu Feb 24 16:08:04 2011
Yes, I got same result with rev 728.
libvirt_ conn.py: reboot( )
self.destroy( instance, False) xml(instance)
self._ conn.createXML( xml, 0) ll(f=None)
----
def reboot(self, instance):
xml = self.to_
timer = utils.LoopingCa
----
self.destroy() called from reboot() deletes iptables rule of this instance. But reboot() function does not re-create iptables rule for this instance.
That is why iptables rules are disappeared when instance is rebooted.
Here are output of iptables-save before and after euca-reboot- instance.
root@usv401: /opt/openstack# euca-run-instances -g secgrp1 -k test -t m1.tiny ami-tiny 24T07:04: 48Z unknown zone /opt/openstack# euca-describe- instances 24T07:04: 48Z nova /opt/openstack# iptables-save /opt/openstack# euca-reboot- instances i-00000001 /opt/openstack# euca-describe- instances 24T07:04: 48Z nova /opt/openstack# iptables-save
RESERVATION r-8xkekwbe admin secgrp1
INSTANCE i-00000001 ami-tiny scheduling test (admin, None) 0 m1.tiny 2011-02-
root@usv401:
RESERVATION r-8xkekwbe admin secgrp1
INSTANCE i-00000001 ami-tiny 10.0.0.3 10.0.0.3 running test (admin, usv401) 0 m1.tiny 2011-02-
root@usv401:
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:06:42 2011
*nat
:PREROUTING ACCEPT [4:939]
:POSTROUTING ACCEPT [25:1500]
:OUTPUT ACCEPT [27:2186]
:SNATTING - [0:0]
-A PREROUTING -d 192.168.6.41/32 -p udp -m udp --dport 2000 -j DNAT --to-destination 10.0.0.2:1194
-A PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.6.41:8773
-A POSTROUTING -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
-A POSTROUTING -s 10.0.0.0/8 -d 10.128.0.0/24 -j ACCEPT
-A POSTROUTING -j SNATTING
-A SNATTING -s 10.0.0.0/8 -j SNAT --to-source 192.168.6.41
COMMIT
# Completed on Thu Feb 24 16:06:42 2011
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:06:42 2011
*filter
:INPUT ACCEPT [28696:167045505]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [28707:167053799]
:nova-fallback - [0:0]
:nova-inst-1 - [0:0]
:nova-local - [0:0]
:nova-sg-2 - [0:0]
-A FORWARD -j nova-local
-A FORWARD -o br100 -j ACCEPT
-A FORWARD -i br100 -j ACCEPT
-A FORWARD -d 10.0.0.2/32 -p udp -m udp --dport 1194 -j ACCEPT
-A OUTPUT -j nova-local
-A nova-fallback -j DROP
-A nova-inst-1 -m state --state INVALID -j DROP
-A nova-inst-1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A nova-inst-1 -j nova-sg-2
-A nova-inst-1 -s 10.0.0.1/32 -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A nova-inst-1 -s 10.0.0.0/27 -j ACCEPT
-A nova-inst-1 -j nova-fallback
-A nova-local -d 10.0.0.3/32 -j nova-inst-1
COMMIT
# Completed on Thu Feb 24 16:06:42 2011
root@usv401:
INSTANCE i-00000001
root@usv401:
RESERVATION r-8xkekwbe admin secgrp1
INSTANCE i-00000001 ami-tiny 10.0.0.3 10.0.0.3 running test (admin, usv401) 0 m1.tiny 2011-02-
root@usv401:
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:08:04 2011
*nat
:PREROUTING ACCEPT [5:1247]
:POSTROUTING ACCEPT [30:1800]
:OUTPUT ACCEPT [33:2829]
:SNATTING - [0:0]
-A PREROUTING -d 192.168.6.41/32 -p udp -m udp --dport 2000 -j DNAT --to-destination 10.0.0.2:1194
-A PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.6.41:8773
-A POSTROUTING -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
-A POSTROUTING -s 10.0.0.0/8 -d 10.128.0.0/24 -j ACCEPT
-A POSTROUTING -j SNATTING
-A SNATTING -s 10.0.0.0/8 -j SNAT --to-source 192.168.6.41
COMMIT
# Completed on Thu Feb 24 16:08:04 2011
# Generated by iptables-save v1.4.4 on Thu Feb 24 16:08:04 2011
*filter
:INPUT ACCEPT [7621:502667]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7638:507563]
:nova-fallback - [0:0]
:nova-local - [0:0]
-A FORWARD -j nova-local
-A FORWARD -o br100 -j ACCEPT
-A FORWARD -i br100 -j ACCEPT
-A FORWARD -d 10.0.0.2/32 -p udp -m udp --dport 1194 -j ACCEPT
-A OUTPUT -j nova-local
-A nova-fallback -j DROP
COMMIT
# Completed on Thu Feb 24 16:08:04 2011