From 01a757ee7bc3624c17dbbcfd3bc65d3e2f674b03 Mon Sep 17 00:00:00 2001
From: Devin Carlen <devin.carlen@gmail.com>
Date: Wed, 15 Sep 2010 17:40:12 -0700
Subject: Added iptables host initial configuration

---
 bin/nova-manage           |  1 +
 nova/endpoint/api.py      |  3 +-
 nova/flags.py             |  5 ++-
 nova/manager.py           | 10 +++++
 nova/network/linux_net.py | 44 +++++++++++++++-------
 nova/network/manager.py   |  7 ++++
 nova/service.py           |  1 +
 tools/setup_ipchains.sh   | 94 +++++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 148 insertions(+), 17 deletions(-)
 create mode 100644 tools/setup_ipchains.sh

diff --git a/bin/nova-manage b/bin/nova-manage
index 325245ac4..909435ede 100755
--- a/bin/nova-manage
+++ b/bin/nova-manage
@@ -384,3 +384,4 @@ def main():
 
 if __name__ == '__main__':
     main()
+
diff --git a/nova/endpoint/api.py b/nova/endpoint/api.py
index 40be00bb7..6de3698e1 100755
--- a/nova/endpoint/api.py
+++ b/nova/endpoint/api.py
@@ -42,8 +42,6 @@ from nova.endpoint import cloud
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_integer('cc_port', 8773, 'cloud controller port')
-
 
 _log = logging.getLogger("api")
 _log.setLevel(logging.DEBUG)
@@ -342,3 +340,4 @@ class APIServerApplication(tornado.web.Application):
             (r'/1.0/([-A-Za-z0-9/]*)', MetadataRequestHandler),
         ], pool=multiprocessing.Pool(4))
         self.controllers = controllers
+
diff --git a/nova/flags.py b/nova/flags.py
index 7b0c95a3c..55b452fc3 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -184,7 +184,9 @@ DEFINE_string('rabbit_userid', 'guest', 'rabbit userid')
 DEFINE_string('rabbit_password', 'guest', 'rabbit password')
 DEFINE_string('rabbit_virtual_host', '/', 'rabbit virtual host')
 DEFINE_string('control_exchange', 'nova', 'the main exchange to connect to')
-DEFINE_string('ec2_url', 'http://127.0.0.1:8773/services/Cloud',
+DEFINE_string('cc_ip', '127.0.0.1', 'ip of api server')
+DEFINE_integer('cc_port', 8773, 'cloud controller port')
+DEFINE_string('ec2_url', 'http://%s:%s/services/Cloud'  % (FLAGS.cc_ip, FLAGS.cc_port),
               'Url to ec2 api server')
 
 DEFINE_string('default_image', 'ami-11111',
@@ -220,3 +222,4 @@ DEFINE_string('host', socket.gethostname(),
 # UNUSED
 DEFINE_string('node_availability_zone', 'nova',
               'availability zone of this node')
+
diff --git a/nova/manager.py b/nova/manager.py
index e9aa50c56..495b1f0d1 100644
--- a/nova/manager.py
+++ b/nova/manager.py
@@ -37,3 +37,13 @@ class Manager(object):
         if not db_driver:
             db_driver = FLAGS.db_driver
         self.db = utils.import_object(db_driver)  # pylint: disable-msg=C0103
+
+    def init_host(self):
+       """Do any initialization that needs to be run if this is a standalone service.
+       
+       Child classes should override this method.
+       """
+
+
+
+
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 41aeb5da7..604d11c93 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -36,13 +36,28 @@ flags.DEFINE_string('dhcpbridge_flagfile',
 flags.DEFINE_string('networks_path', utils.abspath('../networks'),
                     'Location to keep network config files')
 flags.DEFINE_string('public_interface', 'vlan1',
-                        'Interface for public IP addresses')
+                    'Interface for public IP addresses')
 flags.DEFINE_string('bridge_dev', 'eth0',
-                        'network device for bridges')
-
+                    'network device for bridges')
+flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
+                    'Public IP of network host')
 
 DEFAULT_PORTS = [("tcp", 80), ("tcp", 22), ("udp", 1194), ("tcp", 443)]
 
+def init_host():
+    """Basic networking setup goes here"""
+    # NOTE(devcamcar): Cloud public DNAT entries, CloudPipe port
+    # forwarding entries and a default DNAT entry.
+    _confirm_rule("-t nat -A nova_prerouting -s 0.0.0.0/0 "
+             "-d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT "
+             "--to-destination %s:%s" % (FLAGS.cc_ip, FLAGS.cc_port))
+
+    # NOTE(devcamcar): Cloud public SNAT entries and the default
+    # SNAT rule for outbound traffic.
+    _confirm_rule("-t nat -A nova_postrouting -s %s "
+             "-j SNAT --to-source %s"
+             % (FLAGS.private_range, FLAGS.routing_source_ip))
+
 
 def bind_floating_ip(floating_ip):
     """Bind ip to public interface"""
@@ -58,37 +73,37 @@ def unbind_floating_ip(floating_ip):
 
 def ensure_vlan_forward(public_ip, port, private_ip):
     """Sets up forwarding rules for vlan"""
-    _confirm_rule("FORWARD -d %s -p udp --dport 1194 -j ACCEPT" % private_ip)
+    _confirm_rule("nova_forward -d %s -p udp --dport 1194 -j ACCEPT" % private_ip)
     _confirm_rule(
-        "PREROUTING -t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
+        "nova_prerouting -t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
             % (public_ip, port, private_ip))
 
 
 def ensure_floating_forward(floating_ip, fixed_ip):
     """Ensure floating ip forwarding rule"""
-    _confirm_rule("PREROUTING -t nat -d %s -j DNAT --to %s"
+    _confirm_rule("nova_prerouting -t nat -d %s -j DNAT --to %s"
                            % (floating_ip, fixed_ip))
-    _confirm_rule("POSTROUTING -t nat -s %s -j SNAT --to %s"
+    _confirm_rule("nova_postrouting -t nat -s %s -j SNAT --to %s"
                            % (fixed_ip, floating_ip))
     # TODO(joshua): Get these from the secgroup datastore entries
-    _confirm_rule("FORWARD -d %s -p icmp -j ACCEPT"
+    _confirm_rule("nova_forward -d %s -p icmp -j ACCEPT"
                            % (fixed_ip))
     for (protocol, port) in DEFAULT_PORTS:
         _confirm_rule(
-            "FORWARD -d %s -p %s --dport %s -j ACCEPT"
+            "nova_forward -d %s -p %s --dport %s -j ACCEPT"
             % (fixed_ip, protocol, port))
 
 
 def remove_floating_forward(floating_ip, fixed_ip):
     """Remove forwarding for floating ip"""
-    _remove_rule("PREROUTING -t nat -d %s -j DNAT --to %s"
+    _remove_rule("nova_prerouting -t nat -d %s -j DNAT --to %s"
                           % (floating_ip, fixed_ip))
-    _remove_rule("POSTROUTING -t nat -s %s -j SNAT --to %s"
+    _remove_rule("nova_postrouting -t nat -s %s -j SNAT --to %s"
                           % (fixed_ip, floating_ip))
-    _remove_rule("FORWARD -d %s -p icmp -j ACCEPT"
+    _remove_rule("nova_forward -d %s -p icmp -j ACCEPT"
                           % (fixed_ip))
     for (protocol, port) in DEFAULT_PORTS:
-        _remove_rule("FORWARD -d %s -p %s --dport %s -j ACCEPT"
+        _remove_rule("nova_forward -d %s -p %s --dport %s -j ACCEPT"
                               % (fixed_ip, protocol, port))
 
 
@@ -124,7 +139,7 @@ def ensure_bridge(bridge, interface, net_attrs=None):
                      net_attrs['gateway'],
                      net_attrs['broadcast'],
                      net_attrs['netmask']))
-            _confirm_rule("FORWARD --in-interface %s -j ACCEPT" % bridge)
+            _confirm_rule("nova_forward --in-interface %s -j ACCEPT" % bridge)
         else:
             _execute("sudo ifconfig %s up" % bridge)
 
@@ -256,3 +271,4 @@ def _dnsmasq_pid_for(vlan):
     if os.path.exists(pid_file):
         with open(pid_file, 'r') as f:
             return int(f.read())
+
diff --git a/nova/network/manager.py b/nova/network/manager.py
index 7a3bcfc2f..87c3d8e46 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -218,6 +218,12 @@ class FlatManager(NetworkManager):
 
 class VlanManager(NetworkManager):
     """Vlan network with dhcp"""
+    
+        def init_host(self):
+       """Do any initialization that needs to be run if this is a standalone service.
+       """
+       driver.init_host()
+
     def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
         """Gets a fixed ip from the pool"""
         network_ref = self.db.project_get_network(context, context.project.id)
@@ -363,3 +369,4 @@ class VlanManager(NetworkManager):
         parent_reserved = super(VlanManager, self)._top_reserved_ips
         return parent_reserved + FLAGS.cnt_vpn_clients
 
+
diff --git a/nova/service.py b/nova/service.py
index 870dd6ceb..8f1db1b8e 100644
--- a/nova/service.py
+++ b/nova/service.py
@@ -158,3 +158,4 @@ class Service(object, service.Service):
                 self.model_disconnected = True
                 logging.exception("model server went away")
         yield
+
diff --git a/tools/setup_ipchains.sh b/tools/setup_ipchains.sh
new file mode 100644
index 000000000..b1ab1c6f7
--- /dev/null
+++ b/tools/setup_ipchains.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+CMD="global"
+IP="XXX"
+PRIVATE_RANGE="10.128.0.0/12"
+
+if [ -n "$1" ]; then
+    CMD=$1
+fi
+
+if [ -n "$2" ]; then
+    IP=$2
+fi
+
+if [ -n "$3" ]; then
+    PRIVATE_RANGE=$3
+fi
+
+if [ "$CMD" == "global" ]; then
+    iptables -P INPUT DROP
+    iptables -A INPUT -m state --state INVALID -j DROP 
+    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
+    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
+    iptables -N nova_input
+    iptables -A INPUT -j nova_input
+    iptables -A INPUT -p icmp -j ACCEPT 
+    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
+    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable 
+
+    iptables -P FORWARD DROP
+    iptables -A FORWARD -m state --state INVALID -j DROP 
+    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
+    iptables -N nova_forward
+    iptables -A FORWARD -j nova_forward
+
+    iptables -P OUTPUT DROP
+    iptables -A OUTPUT -m state --state INVALID -j DROP 
+    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -N nova_output
+    iptables -A OUTPUT -j nova_output
+    
+    iptables -t nat -N nova_prerouting
+    iptables -t nat -A PREROUTING -j nova_prerouting
+
+    iptables -t nat -N nova_postrouting
+    iptables -t nat -A POSTROUTING -j nova_postrouting
+
+    iptables -t nat -N nova_output
+    iptables -t nat -A OUTPUT -j nova_output
+
+    # ganglia (all hosts)
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
+    iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
+fi
+
+if [ "$CMD" == "dashboard" ]; then
+    # dashboard
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
+fi
+
+if [ "$CMD" == "objectstore" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
+fi
+
+if [ "$CMD" == "redis" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
+fi
+
+if [ "$CMD" == "mysql" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
+fi
+
+if [ "$CMD" == "rabbitmq" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
+fi
+
+if [ "$CMD" == "dnsmasq" ]; then
+    # NOTE(vish): this could theoretically be setup per network
+    #             for each host, but it seems like overkill
+    iptables -A nova_input -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
+    iptables -A nova_input -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
+    iptables -A nova_input -m udp -p udp --dport 67 -j ACCEPT
+
+if [ "$CMD" == "ldap" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
+fi
+
+
-- 
cgit 


From bc2641148359352ed83d4190baaf1e208e00a6b9 Mon Sep 17 00:00:00 2001
From: Devin Carlen <devin.carlen@gmail.com>
Date: Wed, 15 Sep 2010 17:49:15 -0700
Subject: Added iptables host initial configuration

---
 nova/network/manager.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nova/network/manager.py b/nova/network/manager.py
index 87c3d8e46..25a9ba474 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -219,10 +219,11 @@ class FlatManager(NetworkManager):
 class VlanManager(NetworkManager):
     """Vlan network with dhcp"""
     
-        def init_host(self):
-       """Do any initialization that needs to be run if this is a standalone service.
-       """
-       driver.init_host()
+    def init_host(self):
+        """Do any initialization that needs to be run if this is a
+           standalone service.
+        """
+        driver.init_host()
 
     def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
         """Gets a fixed ip from the pool"""
-- 
cgit 


From e1ddec70bc7522a75b4a50953a0f4b20ace6cce1 Mon Sep 17 00:00:00 2001
From: Devin Carlen <devin.carlen@gmail.com>
Date: Thu, 16 Sep 2010 11:40:04 -0700
Subject: Added missing masquerade rules

---
 nova/network/linux_net.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 604d11c93..75acf2afc 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -58,6 +58,8 @@ def init_host():
              "-j SNAT --to-source %s"
              % (FLAGS.private_range, FLAGS.routing_source_ip))
 
+    _confirm_rule("-A nova_postrouting -s %s MASQUERADE" % FLAGS.private_range)
+    _confirm_rule("-A nova_postrouting -s %(range)s -d %(range)s" % {'range': FLAGS.private_range})
 
 def bind_floating_ip(floating_ip):
     """Bind ip to public interface"""
-- 
cgit 


From d0708205759880e7fb78fbb1df33df939f669413 Mon Sep 17 00:00:00 2001
From: Devin Carlen <devin.carlen@gmail.com>
Date: Thu, 16 Sep 2010 11:44:51 -0700
Subject: Whitespace fixes

---
 bin/nova-manage | 1 -
 nova/manager.py | 3 ---
 2 files changed, 4 deletions(-)

diff --git a/bin/nova-manage b/bin/nova-manage
index 909435ede..325245ac4 100755
--- a/bin/nova-manage
+++ b/bin/nova-manage
@@ -384,4 +384,3 @@ def main():
 
 if __name__ == '__main__':
     main()
-
diff --git a/nova/manager.py b/nova/manager.py
index 495b1f0d1..b7b97bced 100644
--- a/nova/manager.py
+++ b/nova/manager.py
@@ -44,6 +44,3 @@ class Manager(object):
        Child classes should override this method.
        """
 
-
-
-
-- 
cgit 


From 68633fadeb92a5a26d1ab613bed6094ddfa2a014 Mon Sep 17 00:00:00 2001
From: Devin Carlen <devin.carlen@gmail.com>
Date: Mon, 20 Sep 2010 15:35:44 -0700
Subject: Whitespace fixes

---
 nova/endpoint/api.py      | 1 -
 nova/flags.py             | 1 -
 nova/network/linux_net.py | 1 -
 nova/network/manager.py   | 1 -
 nova/service.py           | 1 -
 5 files changed, 5 deletions(-)

diff --git a/nova/endpoint/api.py b/nova/endpoint/api.py
index 6de3698e1..56481b2c0 100755
--- a/nova/endpoint/api.py
+++ b/nova/endpoint/api.py
@@ -340,4 +340,3 @@ class APIServerApplication(tornado.web.Application):
             (r'/1.0/([-A-Za-z0-9/]*)', MetadataRequestHandler),
         ], pool=multiprocessing.Pool(4))
         self.controllers = controllers
-
diff --git a/nova/flags.py b/nova/flags.py
index 55b452fc3..ce30d5033 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -222,4 +222,3 @@ DEFINE_string('host', socket.gethostname(),
 # UNUSED
 DEFINE_string('node_availability_zone', 'nova',
               'availability zone of this node')
-
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 75acf2afc..65dcf51ee 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -273,4 +273,3 @@ def _dnsmasq_pid_for(vlan):
     if os.path.exists(pid_file):
         with open(pid_file, 'r') as f:
             return int(f.read())
-
diff --git a/nova/network/manager.py b/nova/network/manager.py
index 25a9ba474..c7bcfa175 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -370,4 +370,3 @@ class VlanManager(NetworkManager):
         parent_reserved = super(VlanManager, self)._top_reserved_ips
         return parent_reserved + FLAGS.cnt_vpn_clients
 
-
diff --git a/nova/service.py b/nova/service.py
index 8f1db1b8e..870dd6ceb 100644
--- a/nova/service.py
+++ b/nova/service.py
@@ -158,4 +158,3 @@ class Service(object, service.Service):
                 self.model_disconnected = True
                 logging.exception("model server went away")
         yield
-
-- 
cgit 


From e74b8070f73d8bada01cfe2d26223e5180ab67fb Mon Sep 17 00:00:00 2001
From: Devin Carlen <devin.carlen@gmail.com>
Date: Tue, 21 Sep 2010 00:03:53 -0700
Subject: Renamed cc_ip flag to cc_host

---
 nova/flags.py             | 4 ++--
 nova/network/linux_net.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/nova/flags.py b/nova/flags.py
index ce30d5033..9d27d336d 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -184,9 +184,9 @@ DEFINE_string('rabbit_userid', 'guest', 'rabbit userid')
 DEFINE_string('rabbit_password', 'guest', 'rabbit password')
 DEFINE_string('rabbit_virtual_host', '/', 'rabbit virtual host')
 DEFINE_string('control_exchange', 'nova', 'the main exchange to connect to')
-DEFINE_string('cc_ip', '127.0.0.1', 'ip of api server')
+DEFINE_string('cc_host', '127.0.0.1', 'ip of api server')
 DEFINE_integer('cc_port', 8773, 'cloud controller port')
-DEFINE_string('ec2_url', 'http://%s:%s/services/Cloud'  % (FLAGS.cc_ip, FLAGS.cc_port),
+DEFINE_string('ec2_url', 'http://%s:%s/services/Cloud' % (FLAGS.cc_host, FLAGS.cc_port),
               'Url to ec2 api server')
 
 DEFINE_string('default_image', 'ami-11111',
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 65dcf51ee..53fb2df94 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -50,7 +50,7 @@ def init_host():
     # forwarding entries and a default DNAT entry.
     _confirm_rule("-t nat -A nova_prerouting -s 0.0.0.0/0 "
              "-d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT "
-             "--to-destination %s:%s" % (FLAGS.cc_ip, FLAGS.cc_port))
+             "--to-destination %s:%s" % (FLAGS.cc_host, FLAGS.cc_port))
 
     # NOTE(devcamcar): Cloud public SNAT entries and the default
     # SNAT rule for outbound traffic.
-- 
cgit 


From 4f2edd43ca2c4a175b4d9dce23ae9e28941122e2 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Thu, 23 Sep 2010 11:23:32 -0700
Subject: renamed ipchains to iptables

---
 setup_iptables.sh       | 94 +++++++++++++++++++++++++++++++++++++++++++++++++
 tools/setup_ipchains.sh | 94 -------------------------------------------------
 2 files changed, 94 insertions(+), 94 deletions(-)
 create mode 100644 setup_iptables.sh
 delete mode 100644 tools/setup_ipchains.sh

diff --git a/setup_iptables.sh b/setup_iptables.sh
new file mode 100644
index 000000000..b1ab1c6f7
--- /dev/null
+++ b/setup_iptables.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+CMD="global"
+IP="XXX"
+PRIVATE_RANGE="10.128.0.0/12"
+
+if [ -n "$1" ]; then
+    CMD=$1
+fi
+
+if [ -n "$2" ]; then
+    IP=$2
+fi
+
+if [ -n "$3" ]; then
+    PRIVATE_RANGE=$3
+fi
+
+if [ "$CMD" == "global" ]; then
+    iptables -P INPUT DROP
+    iptables -A INPUT -m state --state INVALID -j DROP 
+    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
+    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
+    iptables -N nova_input
+    iptables -A INPUT -j nova_input
+    iptables -A INPUT -p icmp -j ACCEPT 
+    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
+    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable 
+
+    iptables -P FORWARD DROP
+    iptables -A FORWARD -m state --state INVALID -j DROP 
+    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
+    iptables -N nova_forward
+    iptables -A FORWARD -j nova_forward
+
+    iptables -P OUTPUT DROP
+    iptables -A OUTPUT -m state --state INVALID -j DROP 
+    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -N nova_output
+    iptables -A OUTPUT -j nova_output
+    
+    iptables -t nat -N nova_prerouting
+    iptables -t nat -A PREROUTING -j nova_prerouting
+
+    iptables -t nat -N nova_postrouting
+    iptables -t nat -A POSTROUTING -j nova_postrouting
+
+    iptables -t nat -N nova_output
+    iptables -t nat -A OUTPUT -j nova_output
+
+    # ganglia (all hosts)
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
+    iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
+fi
+
+if [ "$CMD" == "dashboard" ]; then
+    # dashboard
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
+fi
+
+if [ "$CMD" == "objectstore" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
+fi
+
+if [ "$CMD" == "redis" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
+fi
+
+if [ "$CMD" == "mysql" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
+fi
+
+if [ "$CMD" == "rabbitmq" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
+fi
+
+if [ "$CMD" == "dnsmasq" ]; then
+    # NOTE(vish): this could theoretically be setup per network
+    #             for each host, but it seems like overkill
+    iptables -A nova_input -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
+    iptables -A nova_input -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
+    iptables -A nova_input -m udp -p udp --dport 67 -j ACCEPT
+
+if [ "$CMD" == "ldap" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
+fi
+
+
diff --git a/tools/setup_ipchains.sh b/tools/setup_ipchains.sh
deleted file mode 100644
index b1ab1c6f7..000000000
--- a/tools/setup_ipchains.sh
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-
-CMD="global"
-IP="XXX"
-PRIVATE_RANGE="10.128.0.0/12"
-
-if [ -n "$1" ]; then
-    CMD=$1
-fi
-
-if [ -n "$2" ]; then
-    IP=$2
-fi
-
-if [ -n "$3" ]; then
-    PRIVATE_RANGE=$3
-fi
-
-if [ "$CMD" == "global" ]; then
-    iptables -P INPUT DROP
-    iptables -A INPUT -m state --state INVALID -j DROP 
-    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
-    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
-    iptables -N nova_input
-    iptables -A INPUT -j nova_input
-    iptables -A INPUT -p icmp -j ACCEPT 
-    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable 
-
-    iptables -P FORWARD DROP
-    iptables -A FORWARD -m state --state INVALID -j DROP 
-    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-    iptables -N nova_forward
-    iptables -A FORWARD -j nova_forward
-
-    iptables -P OUTPUT DROP
-    iptables -A OUTPUT -m state --state INVALID -j DROP 
-    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -N nova_output
-    iptables -A OUTPUT -j nova_output
-    
-    iptables -t nat -N nova_prerouting
-    iptables -t nat -A PREROUTING -j nova_prerouting
-
-    iptables -t nat -N nova_postrouting
-    iptables -t nat -A POSTROUTING -j nova_postrouting
-
-    iptables -t nat -N nova_output
-    iptables -t nat -A OUTPUT -j nova_output
-
-    # ganglia (all hosts)
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
-    iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
-fi
-
-if [ "$CMD" == "dashboard" ]; then
-    # dashboard
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
-fi
-
-if [ "$CMD" == "objectstore" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
-fi
-
-if [ "$CMD" == "redis" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
-fi
-
-if [ "$CMD" == "mysql" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
-fi
-
-if [ "$CMD" == "rabbitmq" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
-fi
-
-if [ "$CMD" == "dnsmasq" ]; then
-    # NOTE(vish): this could theoretically be setup per network
-    #             for each host, but it seems like overkill
-    iptables -A nova_input -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
-    iptables -A nova_input -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
-    iptables -A nova_input -m udp -p udp --dport 67 -j ACCEPT
-
-if [ "$CMD" == "ldap" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
-fi
-
-
-- 
cgit 


From 44a3fe22d72f7359f57e7eb9ce443c974391991c Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Thu, 23 Sep 2010 11:40:09 -0700
Subject: fixed a couple of typos

---
 nova/manager.py         | 3 ++-
 nova/network/manager.py | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/nova/manager.py b/nova/manager.py
index b7b97bced..65300354b 100644
--- a/nova/manager.py
+++ b/nova/manager.py
@@ -40,7 +40,8 @@ class Manager(object):
 
     def init_host(self):
        """Do any initialization that needs to be run if this is a standalone service.
-       
+
        Child classes should override this method.
        """
+       pass
 
diff --git a/nova/network/manager.py b/nova/network/manager.py
index dcca21127..abe4dcebc 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -218,12 +218,12 @@ class FlatManager(NetworkManager):
 
 class VlanManager(NetworkManager):
     """Vlan network with dhcp"""
-    
+
     def init_host(self):
         """Do any initialization that needs to be run if this is a
            standalone service.
         """
-        driver.init_host()
+        self.driver.init_host()
 
     def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
         """Gets a fixed ip from the pool"""
-- 
cgit 


From 47a957acb176d108aac4183cbf5a882149d7462d Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Thu, 23 Sep 2010 11:58:33 -0700
Subject: put setup_iptables in the right dir

---
 setup_iptables.sh       | 94 -------------------------------------------------
 tools/setup_iptables.sh | 94 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 94 insertions(+), 94 deletions(-)
 delete mode 100644 setup_iptables.sh
 create mode 100644 tools/setup_iptables.sh

diff --git a/setup_iptables.sh b/setup_iptables.sh
deleted file mode 100644
index b1ab1c6f7..000000000
--- a/setup_iptables.sh
+++ /dev/null
@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-
-CMD="global"
-IP="XXX"
-PRIVATE_RANGE="10.128.0.0/12"
-
-if [ -n "$1" ]; then
-    CMD=$1
-fi
-
-if [ -n "$2" ]; then
-    IP=$2
-fi
-
-if [ -n "$3" ]; then
-    PRIVATE_RANGE=$3
-fi
-
-if [ "$CMD" == "global" ]; then
-    iptables -P INPUT DROP
-    iptables -A INPUT -m state --state INVALID -j DROP 
-    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
-    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
-    iptables -N nova_input
-    iptables -A INPUT -j nova_input
-    iptables -A INPUT -p icmp -j ACCEPT 
-    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable 
-
-    iptables -P FORWARD DROP
-    iptables -A FORWARD -m state --state INVALID -j DROP 
-    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-    iptables -N nova_forward
-    iptables -A FORWARD -j nova_forward
-
-    iptables -P OUTPUT DROP
-    iptables -A OUTPUT -m state --state INVALID -j DROP 
-    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -N nova_output
-    iptables -A OUTPUT -j nova_output
-    
-    iptables -t nat -N nova_prerouting
-    iptables -t nat -A PREROUTING -j nova_prerouting
-
-    iptables -t nat -N nova_postrouting
-    iptables -t nat -A POSTROUTING -j nova_postrouting
-
-    iptables -t nat -N nova_output
-    iptables -t nat -A OUTPUT -j nova_output
-
-    # ganglia (all hosts)
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
-    iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
-fi
-
-if [ "$CMD" == "dashboard" ]; then
-    # dashboard
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
-fi
-
-if [ "$CMD" == "objectstore" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
-fi
-
-if [ "$CMD" == "redis" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
-fi
-
-if [ "$CMD" == "mysql" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
-fi
-
-if [ "$CMD" == "rabbitmq" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
-fi
-
-if [ "$CMD" == "dnsmasq" ]; then
-    # NOTE(vish): this could theoretically be setup per network
-    #             for each host, but it seems like overkill
-    iptables -A nova_input -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
-    iptables -A nova_input -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
-    iptables -A nova_input -m udp -p udp --dport 67 -j ACCEPT
-
-if [ "$CMD" == "ldap" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
-fi
-
-
diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
new file mode 100644
index 000000000..b1ab1c6f7
--- /dev/null
+++ b/tools/setup_iptables.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+CMD="global"
+IP="XXX"
+PRIVATE_RANGE="10.128.0.0/12"
+
+if [ -n "$1" ]; then
+    CMD=$1
+fi
+
+if [ -n "$2" ]; then
+    IP=$2
+fi
+
+if [ -n "$3" ]; then
+    PRIVATE_RANGE=$3
+fi
+
+if [ "$CMD" == "global" ]; then
+    iptables -P INPUT DROP
+    iptables -A INPUT -m state --state INVALID -j DROP 
+    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
+    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
+    iptables -N nova_input
+    iptables -A INPUT -j nova_input
+    iptables -A INPUT -p icmp -j ACCEPT 
+    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
+    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable 
+
+    iptables -P FORWARD DROP
+    iptables -A FORWARD -m state --state INVALID -j DROP 
+    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
+    iptables -N nova_forward
+    iptables -A FORWARD -j nova_forward
+
+    iptables -P OUTPUT DROP
+    iptables -A OUTPUT -m state --state INVALID -j DROP 
+    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+    iptables -N nova_output
+    iptables -A OUTPUT -j nova_output
+    
+    iptables -t nat -N nova_prerouting
+    iptables -t nat -A PREROUTING -j nova_prerouting
+
+    iptables -t nat -N nova_postrouting
+    iptables -t nat -A POSTROUTING -j nova_postrouting
+
+    iptables -t nat -N nova_output
+    iptables -t nat -A OUTPUT -j nova_output
+
+    # ganglia (all hosts)
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
+    iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
+fi
+
+if [ "$CMD" == "dashboard" ]; then
+    # dashboard
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
+fi
+
+if [ "$CMD" == "objectstore" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
+fi
+
+if [ "$CMD" == "redis" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
+fi
+
+if [ "$CMD" == "mysql" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
+fi
+
+if [ "$CMD" == "rabbitmq" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
+fi
+
+if [ "$CMD" == "dnsmasq" ]; then
+    # NOTE(vish): this could theoretically be setup per network
+    #             for each host, but it seems like overkill
+    iptables -A nova_input -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
+    iptables -A nova_input -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
+    iptables -A nova_input -m udp -p udp --dport 67 -j ACCEPT
+
+if [ "$CMD" == "ldap" ]; then
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
+fi
+
+
-- 
cgit 


From 564105a3f0087f31a879460d70e73bc358e0e8c0 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Thu, 23 Sep 2010 12:18:56 -0700
Subject: made use of nova_ chains a flag and fixed a few typos

---
 nova/network/linux_net.py | 46 ++++++++++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 20 deletions(-)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 53fb2df94..149848750 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -41,6 +41,8 @@ flags.DEFINE_string('bridge_dev', 'eth0',
                     'network device for bridges')
 flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
                     'Public IP of network host')
+flags.DEFINE_string('use_nova_chains', False,
+                    'use the nova_ routing chains instead of default')
 
 DEFAULT_PORTS = [("tcp", 80), ("tcp", 22), ("udp", 1194), ("tcp", 443)]
 
@@ -48,18 +50,18 @@ def init_host():
     """Basic networking setup goes here"""
     # NOTE(devcamcar): Cloud public DNAT entries, CloudPipe port
     # forwarding entries and a default DNAT entry.
-    _confirm_rule("-t nat -A nova_prerouting -s 0.0.0.0/0 "
+    _confirm_rule("PREROUTING", "-t nat -s 0.0.0.0/0 "
              "-d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT "
              "--to-destination %s:%s" % (FLAGS.cc_host, FLAGS.cc_port))
 
     # NOTE(devcamcar): Cloud public SNAT entries and the default
     # SNAT rule for outbound traffic.
-    _confirm_rule("-t nat -A nova_postrouting -s %s "
+    _confirm_rule("POSTROUTING", "-t nat -s %s "
              "-j SNAT --to-source %s"
              % (FLAGS.private_range, FLAGS.routing_source_ip))
 
-    _confirm_rule("-A nova_postrouting -s %s MASQUERADE" % FLAGS.private_range)
-    _confirm_rule("-A nova_postrouting -s %(range)s -d %(range)s" % {'range': FLAGS.private_range})
+    _confirm_rule("POSTROUTING", "-t nat -s %s MASQUERADE" % FLAGS.private_range)
+    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s" % {'range': FLAGS.private_range})
 
 def bind_floating_ip(floating_ip):
     """Bind ip to public interface"""
@@ -75,37 +77,37 @@ def unbind_floating_ip(floating_ip):
 
 def ensure_vlan_forward(public_ip, port, private_ip):
     """Sets up forwarding rules for vlan"""
-    _confirm_rule("nova_forward -d %s -p udp --dport 1194 -j ACCEPT" % private_ip)
+    _confirm_rule("FORWARD", "-d %s -p udp --dport 1194 -j ACCEPT" % private_ip)
     _confirm_rule(
-        "nova_prerouting -t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
+        "PREROUTING -t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
             % (public_ip, port, private_ip))
 
 
 def ensure_floating_forward(floating_ip, fixed_ip):
     """Ensure floating ip forwarding rule"""
-    _confirm_rule("nova_prerouting -t nat -d %s -j DNAT --to %s"
+    _confirm_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
                            % (floating_ip, fixed_ip))
-    _confirm_rule("nova_postrouting -t nat -s %s -j SNAT --to %s"
+    _confirm_rule("POSTROUTING", "-t nat -s %s -j SNAT --to %s"
                            % (fixed_ip, floating_ip))
     # TODO(joshua): Get these from the secgroup datastore entries
-    _confirm_rule("nova_forward -d %s -p icmp -j ACCEPT"
+    _confirm_rule("FORWARD", "-d %s -p icmp -j ACCEPT"
                            % (fixed_ip))
     for (protocol, port) in DEFAULT_PORTS:
         _confirm_rule(
-            "nova_forward -d %s -p %s --dport %s -j ACCEPT"
+            "FORWARD -d %s -p %s --dport %s -j ACCEPT"
             % (fixed_ip, protocol, port))
 
 
 def remove_floating_forward(floating_ip, fixed_ip):
     """Remove forwarding for floating ip"""
-    _remove_rule("nova_prerouting -t nat -d %s -j DNAT --to %s"
+    _remove_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
                           % (floating_ip, fixed_ip))
-    _remove_rule("nova_postrouting -t nat -s %s -j SNAT --to %s"
+    _remove_rule("POSTROUTING", "-t nat -s %s -j SNAT --to %s"
                           % (fixed_ip, floating_ip))
-    _remove_rule("nova_forward -d %s -p icmp -j ACCEPT"
+    _remove_rule("FORWARD", "-d %s -p icmp -j ACCEPT"
                           % (fixed_ip))
     for (protocol, port) in DEFAULT_PORTS:
-        _remove_rule("nova_forward -d %s -p %s --dport %s -j ACCEPT"
+        _remove_rule("FORWARD", "-d %s -p %s --dport %s -j ACCEPT"
                               % (fixed_ip, protocol, port))
 
 
@@ -141,7 +143,7 @@ def ensure_bridge(bridge, interface, net_attrs=None):
                      net_attrs['gateway'],
                      net_attrs['broadcast'],
                      net_attrs['netmask']))
-            _confirm_rule("nova_forward --in-interface %s -j ACCEPT" % bridge)
+            _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
         else:
             _execute("sudo ifconfig %s up" % bridge)
 
@@ -211,15 +213,19 @@ def _device_exists(device):
     return not err
 
 
-def _confirm_rule(cmd):
+def _confirm_rule(chain, cmd):
     """Delete and re-add iptables rule"""
-    _execute("sudo iptables --delete %s" % (cmd), check_exit_code=False)
-    _execute("sudo iptables -I %s" % (cmd))
+    if FLAGS.use_nova_chains:
+        chain = "nova_%s" % chain.lower()
+    _execute("sudo iptables --delete %s %s" % (chain, cmd), check_exit_code=False)
+    _execute("sudo iptables -I %s %s" % (chain, cmd))
 
 
-def _remove_rule(cmd):
+def _remove_rule(chain, cmd):
     """Remove iptables rule"""
-    _execute("sudo iptables --delete %s" % (cmd))
+    if FLAGS.use_nova_chains:
+        chain = "%S" % chain.lower()
+    _execute("sudo iptables --delete %s %s" % (chain, cmd))
 
 
 def _dnsmasq_cmd(net):
-- 
cgit 


From 81fc2078ca3d3e07728a39b6cdec47af871f2f2f Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Thu, 23 Sep 2010 12:20:40 -0700
Subject: removed extra line in manage

---
 nova/manager.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nova/manager.py b/nova/manager.py
index 65300354b..94e4ae959 100644
--- a/nova/manager.py
+++ b/nova/manager.py
@@ -44,4 +44,3 @@ class Manager(object):
        Child classes should override this method.
        """
        pass
-
-- 
cgit 


From 065257fb0686d848fcf20235a4e04b76872a5b01 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Thu, 23 Sep 2010 12:43:41 -0700
Subject: fixed a few missing params from iptables rules

---
 nova/network/linux_net.py | 4 ++--
 nova/service.py           | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 149848750..38a616e83 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -60,8 +60,8 @@ def init_host():
              "-j SNAT --to-source %s"
              % (FLAGS.private_range, FLAGS.routing_source_ip))
 
-    _confirm_rule("POSTROUTING", "-t nat -s %s MASQUERADE" % FLAGS.private_range)
-    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s" % {'range': FLAGS.private_range})
+    _confirm_rule("POSTROUTING", "-t nat -s %s -j MASQUERADE" % FLAGS.private_range)
+    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s -j ACCEPT" % {'range': FLAGS.private_range})
 
 def bind_floating_ip(floating_ip):
     """Bind ip to public interface"""
diff --git a/nova/service.py b/nova/service.py
index 870dd6ceb..dcd2a09ef 100644
--- a/nova/service.py
+++ b/nova/service.py
@@ -50,6 +50,7 @@ class Service(object, service.Service):
         self.topic = topic
         manager_class = utils.import_class(manager)
         self.manager = manager_class(host=host, *args, **kwargs)
+        self.manager.init_host()
         self.model_disconnected = False
         super(Service, self).__init__(*args, **kwargs)
         try:
-- 
cgit 


From 15c2678d3e3899e7ab6180dce457ae6d3e54937d Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Fri, 24 Sep 2010 18:21:58 -0700
Subject: improved the shell script for iptables

---
 tools/setup_iptables.sh | 124 ++++++++++++++++++++++++++++++------------------
 1 file changed, 78 insertions(+), 46 deletions(-)
 mode change 100644 => 100755 tools/setup_iptables.sh

diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
old mode 100644
new mode 100755
index b1ab1c6f7..fd32f6f82
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -1,93 +1,125 @@
 #!/usr/bin/env bash
-
-CMD="global"
-IP="XXX"
-PRIVATE_RANGE="10.128.0.0/12"
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
 
 if [ -n "$1" ]; then
     CMD=$1
+else
+    CMD="all"
 fi
 
 if [ -n "$2" ]; then
     IP=$2
+else
+    # NOTE(vish): this will just get the first ip in the list, so if you
+    #             have more than one eth device set up, this will fail
+    IP=`ifconfig  | grep -m 1 'inet addr:'| cut -d: -f2 | awk '{print $1}'`
 fi
 
 if [ -n "$3" ]; then
     PRIVATE_RANGE=$3
+else
+    PRIVATE_RANGE="10.0.0.0/12"
+fi
+
+
+if [ -n "$4" ]; then
+    MGMT_IP=$4
+else
+    MGMT_IP="$IP"
 fi
 
-if [ "$CMD" == "global" ]; then
-    iptables -P INPUT DROP
-    iptables -A INPUT -m state --state INVALID -j DROP 
-    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
-    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
-    iptables -N nova_input
-    iptables -A INPUT -j nova_input
-    iptables -A INPUT -p icmp -j ACCEPT 
-    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable 
-
-    iptables -P FORWARD DROP
-    iptables -A FORWARD -m state --state INVALID -j DROP 
-    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-    iptables -N nova_forward
-    iptables -A FORWARD -j nova_forward
-
-    iptables -P OUTPUT DROP
-    iptables -A OUTPUT -m state --state INVALID -j DROP 
-    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-    iptables -N nova_output
-    iptables -A OUTPUT -j nova_output
-    
-    iptables -t nat -N nova_prerouting
-    iptables -t nat -A PREROUTING -j nova_prerouting
-
-    iptables -t nat -N nova_postrouting
-    iptables -t nat -A POSTROUTING -j nova_postrouting
-
-    iptables -t nat -N nova_output
-    iptables -t nat -A OUTPUT -j nova_output
-
-    # ganglia (all hosts)
+iptables -F
+iptables -P INPUT DROP
+iptables -A INPUT -m state --state INVALID -j DROP
+iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
+iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
+iptables -N nova_input
+iptables -A INPUT -j nova_input
+iptables -A INPUT -p icmp -j ACCEPT
+iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
+iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
+
+iptables -P FORWARD DROP
+iptables -A FORWARD -m state --state INVALID -j DROP
+iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+iptables -N nova_forward
+iptables -A FORWARD -j nova_forward
+
+iptables -P OUTPUT DROP
+iptables -A OUTPUT -m state --state INVALID -j DROP
+iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -N nova_output
+iptables -A OUTPUT -j nova_output
+
+iptables -t nat -N nova_prerouting
+iptables -t nat -A PREROUTING -j nova_prerouting
+
+iptables -t nat -N nova_postrouting
+iptables -t nat -A POSTROUTING -j nova_postrouting
+
+iptables -t nat -N nova_output
+iptables -t nat -A OUTPUT -j nova_output
+
+if [ "$CMD" == "ganglia" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
     iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
 fi
 
-if [ "$CMD" == "dashboard" ]; then
+if [ "$CMD" == "dashboard" ] || [ "$CMD" == "all" ]; then
     # dashboard
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
 fi
 
-if [ "$CMD" == "objectstore" ]; then
+if [ "$CMD" == "objectstore" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
+fi
+
+if [ "$CMD" == "api" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
 fi
 
-if [ "$CMD" == "redis" ]; then
+if [ "$CMD" == "redis" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
 fi
 
-if [ "$CMD" == "mysql" ]; then
+if [ "$CMD" == "mysql" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
 fi
 
-if [ "$CMD" == "rabbitmq" ]; then
+if [ "$CMD" == "rabbitmq" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
 fi
 
-if [ "$CMD" == "dnsmasq" ]; then
+if [ "$CMD" == "dnsmasq" ] || [ "$CMD" == "all" ]; then
     # NOTE(vish): this could theoretically be setup per network
     #             for each host, but it seems like overkill
     iptables -A nova_input -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
     iptables -A nova_input -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
     iptables -A nova_input -m udp -p udp --dport 67 -j ACCEPT
+fi
 
-if [ "$CMD" == "ldap" ]; then
+if [ "$CMD" == "ldap" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
 fi
 
-- 
cgit 


From 41a598f09baee94125608873f4d7118000fc55ea Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Fri, 24 Sep 2010 19:57:41 -0700
Subject: add a reset command

---
 tools/setup_iptables.sh | 74 +++++++++++++++++++++++++++----------------------
 1 file changed, 41 insertions(+), 33 deletions(-)

diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
index fd32f6f82..7368fadf9 100755
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -43,40 +43,48 @@ if [ -n "$4" ]; then
 else
     MGMT_IP="$IP"
 fi
+if [ "$CMD" == "clear" ]; then
+    iptables -P INPUT ACCEPT
+    iptables -P FORWARD ACCEPT
+    iptables -P OUTPUT ACCEPT
+    iptables -F
+    iptables -X
+fi
 
-iptables -F
-iptables -P INPUT DROP
-iptables -A INPUT -m state --state INVALID -j DROP
-iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
-iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
-iptables -N nova_input
-iptables -A INPUT -j nova_input
-iptables -A INPUT -p icmp -j ACCEPT
-iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
-iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
-
-iptables -P FORWARD DROP
-iptables -A FORWARD -m state --state INVALID -j DROP
-iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-iptables -N nova_forward
-iptables -A FORWARD -j nova_forward
-
-iptables -P OUTPUT DROP
-iptables -A OUTPUT -m state --state INVALID -j DROP
-iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -N nova_output
-iptables -A OUTPUT -j nova_output
-
-iptables -t nat -N nova_prerouting
-iptables -t nat -A PREROUTING -j nova_prerouting
-
-iptables -t nat -N nova_postrouting
-iptables -t nat -A POSTROUTING -j nova_postrouting
-
-iptables -t nat -N nova_output
-iptables -t nat -A OUTPUT -j nova_output
+if [ "$CMD" == "base" ] || [ "$CMD" == "all" ]; then
+    iptables -P INPUT DROP
+    iptables -A INPUT -m state --state INVALID -j DROP
+    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+    iptables -A INPUT -m tcp -p tcp -d $MGMT_IP --dport 22 -j ACCEPT
+    iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
+    iptables -N nova_input
+    iptables -A INPUT -j nova_input
+    iptables -A INPUT -p icmp -j ACCEPT
+    iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
+    iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
+
+    iptables -P FORWARD DROP
+    iptables -A FORWARD -m state --state INVALID -j DROP
+    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
+    iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+    iptables -N nova_forward
+    iptables -A FORWARD -j nova_forward
+
+    iptables -P OUTPUT DROP
+    iptables -A OUTPUT -m state --state INVALID -j DROP
+    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+    iptables -N nova_output
+    iptables -A OUTPUT -j nova_output
+
+    iptables -t nat -N nova_prerouting
+    iptables -t nat -A PREROUTING -j nova_prerouting
+
+    iptables -t nat -N nova_postrouting
+    iptables -t nat -A POSTROUTING -j nova_postrouting
+
+    iptables -t nat -N nova_output
+    iptables -t nat -A OUTPUT -j nova_output
+fi
 
 if [ "$CMD" == "ganglia" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
-- 
cgit 


From c3fcb1b2176f4b7afbffb3555da55c0754bacaad Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 01:05:39 -0700
Subject: flush the nova chains

---
 tools/setup_iptables.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
index 7368fadf9..d045b50cd 100755
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -48,6 +48,9 @@ if [ "$CMD" == "clear" ]; then
     iptables -P FORWARD ACCEPT
     iptables -P OUTPUT ACCEPT
     iptables -F
+    iptables -F nova_input
+    iptables -F nova_output
+    iptables -F nova_forward
     iptables -X
 fi
 
-- 
cgit 


From 125e69dd42f6f91f727258dc388d15ce63076d1f Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 02:51:50 -0700
Subject: allow mgmt ip access to api

---
 tools/setup_iptables.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
index d045b50cd..b7e2f9a11 100755
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -106,6 +106,9 @@ fi
 
 if [ "$CMD" == "api" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
+    if [ "$IP" != "$MGMT_IP" ]; then
+        iptables -A nova_input -m tcp -p tcp -d $MGMT_IP --dport 8773 -j ACCEPT
+    fi
 fi
 
 if [ "$CMD" == "redis" ] || [ "$CMD" == "all" ]; then
-- 
cgit 


From 7ce67ea60f6e7d20665c10318b29e2659fd91513 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 08:35:16 -0700
Subject: fix a few missed calls to _confirm_rule and 80 char issues

---
 nova/network/linux_net.py | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 38a616e83..8058c970d 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -60,8 +60,10 @@ def init_host():
              "-j SNAT --to-source %s"
              % (FLAGS.private_range, FLAGS.routing_source_ip))
 
-    _confirm_rule("POSTROUTING", "-t nat -s %s -j MASQUERADE" % FLAGS.private_range)
-    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s -j ACCEPT" % {'range': FLAGS.private_range})
+    _confirm_rule("POSTROUTING", "-t nat -s %s -j MASQUERADE" %
+                  FLAGS.private_range)
+    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s -j ACCEPT" %
+                  {'range': FLAGS.private_range})
 
 def bind_floating_ip(floating_ip):
     """Bind ip to public interface"""
@@ -77,9 +79,10 @@ def unbind_floating_ip(floating_ip):
 
 def ensure_vlan_forward(public_ip, port, private_ip):
     """Sets up forwarding rules for vlan"""
-    _confirm_rule("FORWARD", "-d %s -p udp --dport 1194 -j ACCEPT" % private_ip)
-    _confirm_rule(
-        "PREROUTING -t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
+    _confirm_rule("FORWARD", "-d %s -p udp --dport 1194 -j ACCEPT" %
+                  private_ip)
+    _confirm_rule("PREROUTING",
+                  "-t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
             % (public_ip, port, private_ip))
 
 
@@ -93,8 +96,7 @@ def ensure_floating_forward(floating_ip, fixed_ip):
     _confirm_rule("FORWARD", "-d %s -p icmp -j ACCEPT"
                            % (fixed_ip))
     for (protocol, port) in DEFAULT_PORTS:
-        _confirm_rule(
-            "FORWARD -d %s -p %s --dport %s -j ACCEPT"
+        _confirm_rule("FORWARD","-d %s -p %s --dport %s -j ACCEPT"
             % (fixed_ip, protocol, port))
 
 
-- 
cgit 


From 888a99182ca3152f68b762dab4fc95d7d3f1cadb Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 09:28:05 -0700
Subject: add forwarding ACCEPT for outgoing packets on compute host

---
 nova/network/linux_net.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 8058c970d..78cc64cb0 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -148,6 +148,7 @@ def ensure_bridge(bridge, interface, net_attrs=None):
             _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
         else:
             _execute("sudo ifconfig %s up" % bridge)
+            _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
 
 
 def get_dhcp_hosts(context, network_id):
-- 
cgit 


From 6a3cd55a9c933c329da1117179d676e9141c5b4d Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 10:47:51 -0700
Subject: disable output drop for the moment because it is too restrictive

---
 tools/setup_iptables.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
index b7e2f9a11..dd91c76e0 100755
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -52,6 +52,11 @@ if [ "$CMD" == "clear" ]; then
     iptables -F nova_output
     iptables -F nova_forward
     iptables -X
+    iptables -t nat -F
+    iptables -t nat -F nova_input
+    iptables -t nat -F nova_output
+    iptables -t nat -F nova_forward
+    iptables -t nat -X
 fi
 
 if [ "$CMD" == "base" ] || [ "$CMD" == "all" ]; then
@@ -73,7 +78,7 @@ if [ "$CMD" == "base" ] || [ "$CMD" == "all" ]; then
     iptables -N nova_forward
     iptables -A FORWARD -j nova_forward
 
-    iptables -P OUTPUT DROP
+    # iptables -P OUTPUT DROP  # too restrictive for the moment
     iptables -A OUTPUT -m state --state INVALID -j DROP
     iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     iptables -N nova_output
-- 
cgit 


From 0d0884b2c1692d03e0994baecbb23ce24ef71e44 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 13:53:29 -0700
Subject: allow in and out for network and compute hosts

---
 nova/network/linux_net.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 78cc64cb0..6b47b6d97 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -145,10 +145,10 @@ def ensure_bridge(bridge, interface, net_attrs=None):
                      net_attrs['gateway'],
                      net_attrs['broadcast'],
                      net_attrs['netmask']))
-            _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
         else:
             _execute("sudo ifconfig %s up" % bridge)
-            _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
+        _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
+        _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
 
 
 def get_dhcp_hosts(context, network_id):
-- 
cgit 


From 5d6ab2b2540743e0a53b01129df722610b3ae3b6 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Sat, 25 Sep 2010 18:33:27 -0700
Subject: reorganize iptables clear and make sure use_nova_chains is a boolean

---
 nova/network/linux_net.py | 4 ++--
 tools/setup_iptables.sh   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 6b47b6d97..01a1d2ad0 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -41,8 +41,8 @@ flags.DEFINE_string('bridge_dev', 'eth0',
                     'network device for bridges')
 flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
                     'Public IP of network host')
-flags.DEFINE_string('use_nova_chains', False,
-                    'use the nova_ routing chains instead of default')
+flags.DEFINE_boo('use_nova_chains', False,
+                 'use the nova_ routing chains instead of default')
 
 DEFAULT_PORTS = [("tcp", 80), ("tcp", 22), ("udp", 1194), ("tcp", 443)]
 
diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
index dd91c76e0..b6b8414e3 100755
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -48,15 +48,15 @@ if [ "$CMD" == "clear" ]; then
     iptables -P FORWARD ACCEPT
     iptables -P OUTPUT ACCEPT
     iptables -F
+    iptables -t nat -F
     iptables -F nova_input
     iptables -F nova_output
     iptables -F nova_forward
-    iptables -X
-    iptables -t nat -F
     iptables -t nat -F nova_input
     iptables -t nat -F nova_output
     iptables -t nat -F nova_forward
     iptables -t nat -X
+    iptables -X
 fi
 
 if [ "$CMD" == "base" ] || [ "$CMD" == "all" ]; then
-- 
cgit 


From 1e4bca12e7e06698d3a13d6a208be90647f27555 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Tue, 28 Sep 2010 17:15:59 -0700
Subject: typo s/boo/bool

---
 nova/network/linux_net.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 01a1d2ad0..6f1d594fa 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -41,8 +41,8 @@ flags.DEFINE_string('bridge_dev', 'eth0',
                     'network device for bridges')
 flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
                     'Public IP of network host')
-flags.DEFINE_boo('use_nova_chains', False,
-                 'use the nova_ routing chains instead of default')
+flags.DEFINE_bool('use_nova_chains', False,
+                  'use the nova_ routing chains instead of default')
 
 DEFAULT_PORTS = [("tcp", 80), ("tcp", 22), ("udp", 1194), ("tcp", 443)]
 
-- 
cgit 


From 533f72379931aa7bf67a0e7d1d7664ca151afda0 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Tue, 28 Sep 2010 17:24:25 -0700
Subject: fix flag defaults

---
 nova/flags.py             | 2 +-
 nova/network/linux_net.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nova/flags.py b/nova/flags.py
index 5ed0f92ee..92f6766cf 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -190,7 +190,7 @@ DEFINE_string('rabbit_virtual_host', '/', 'rabbit virtual host')
 DEFINE_string('control_exchange', 'nova', 'the main exchange to connect to')
 DEFINE_string('cc_host', '127.0.0.1', 'ip of api server')
 DEFINE_integer('cc_port', 8773, 'cloud controller port')
-DEFINE_string('ec2_url', 'http://%s:%s/services/Cloud' % (FLAGS.cc_host, FLAGS.cc_port),
+DEFINE_string('ec2_url', 'http://127.0.0.1:8773/services/Cloud'
               'Url to ec2 api server')
 
 DEFINE_string('default_image', 'ami-11111',
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 6f1d594fa..fa77c5ba8 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -39,7 +39,7 @@ flags.DEFINE_string('public_interface', 'vlan1',
                     'Interface for public IP addresses')
 flags.DEFINE_string('bridge_dev', 'eth0',
                     'network device for bridges')
-flags.DEFINE_string('routing_source_ip', utils.get_my_ip(),
+flags.DEFINE_string('routing_source_ip', '127.0.0.1',
                     'Public IP of network host')
 flags.DEFINE_bool('use_nova_chains', False,
                   'use the nova_ routing chains instead of default')
-- 
cgit 


From d1c454ba4331794931e94cc2864f4e1a6ef5bf22 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Tue, 28 Sep 2010 17:41:57 -0700
Subject: improved commenting

---
 tools/setup_iptables.sh | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/tools/setup_iptables.sh b/tools/setup_iptables.sh
index b6b8414e3..673353eb4 100755
--- a/tools/setup_iptables.sh
+++ b/tools/setup_iptables.sh
@@ -17,6 +17,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+# NOTE(vish): This script sets up some reasonable defaults for iptables and
+#             creates nova-specific chains.  If you use this script you should
+#             run nova-network and nova-compute with --use_nova_chains=True
+
+# NOTE(vish): If you run nova-api on a different port, make sure to change
+#             the port here
+API_PORT=${API_PORT:-"8773"}
 if [ -n "$1" ]; then
     CMD=$1
 else
@@ -26,8 +33,9 @@ fi
 if [ -n "$2" ]; then
     IP=$2
 else
-    # NOTE(vish): this will just get the first ip in the list, so if you
-    #             have more than one eth device set up, this will fail
+    # NOTE(vish): This will just get the first ip in the list, so if you
+    #             have more than one eth device set up, this will fail, and
+    #             you should explicitly pass in the ip of the instance
     IP=`ifconfig  | grep -m 1 'inet addr:'| cut -d: -f2 | awk '{print $1}'`
 fi
 
@@ -39,6 +47,8 @@ fi
 
 
 if [ -n "$4" ]; then
+    # NOTE(vish): Management IP is the ip over which to allow ssh traffic.  It
+    #             will also allow traffic to nova-api
     MGMT_IP=$4
 else
     MGMT_IP="$IP"
@@ -78,7 +88,9 @@ if [ "$CMD" == "base" ] || [ "$CMD" == "all" ]; then
     iptables -N nova_forward
     iptables -A FORWARD -j nova_forward
 
-    # iptables -P OUTPUT DROP  # too restrictive for the moment
+    # NOTE(vish): DROP on output is too restrictive for now.  We need to add
+    #             in a bunch of more specific output rules to use it.
+    # iptables -P OUTPUT DROP
     iptables -A OUTPUT -m state --state INVALID -j DROP
     iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     iptables -N nova_output
@@ -99,8 +111,9 @@ if [ "$CMD" == "ganglia" ] || [ "$CMD" == "all" ]; then
     iptables -A nova_input -m udp -p udp -d $IP --dport 8649 -j ACCEPT
 fi
 
-if [ "$CMD" == "dashboard" ] || [ "$CMD" == "all" ]; then
-    # dashboard
+if [ "$CMD" == "web" ] || [ "$CMD" == "all" ]; then
+    # NOTE(vish): This opens up ports for web access, allowing web-based
+    #             dashboards to work.
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
     iptables -A nova_input -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
 fi
@@ -110,9 +123,9 @@ if [ "$CMD" == "objectstore" ] || [ "$CMD" == "all" ]; then
 fi
 
 if [ "$CMD" == "api" ] || [ "$CMD" == "all" ]; then
-    iptables -A nova_input -m tcp -p tcp -d $IP --dport 8773 -j ACCEPT
+    iptables -A nova_input -m tcp -p tcp -d $IP --dport $API_PORT -j ACCEPT
     if [ "$IP" != "$MGMT_IP" ]; then
-        iptables -A nova_input -m tcp -p tcp -d $MGMT_IP --dport 8773 -j ACCEPT
+        iptables -A nova_input -m tcp -p tcp -d $MGMT_IP --dport $API_PORT -j ACCEPT
     fi
 fi
 
-- 
cgit 


From bc88c73a4e986289be7835b95ec97ffb7a50f7d7 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@yahoo.com>
Date: Tue, 28 Sep 2010 17:53:27 -0700
Subject: missed a comma

---
 nova/flags.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nova/flags.py b/nova/flags.py
index 92f6766cf..c32cdd7a4 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -190,7 +190,7 @@ DEFINE_string('rabbit_virtual_host', '/', 'rabbit virtual host')
 DEFINE_string('control_exchange', 'nova', 'the main exchange to connect to')
 DEFINE_string('cc_host', '127.0.0.1', 'ip of api server')
 DEFINE_integer('cc_port', 8773, 'cloud controller port')
-DEFINE_string('ec2_url', 'http://127.0.0.1:8773/services/Cloud'
+DEFINE_string('ec2_url', 'http://127.0.0.1:8773/services/Cloud',
               'Url to ec2 api server')
 
 DEFINE_string('default_image', 'ami-11111',
-- 
cgit