F-12 host, can't acquire DHCP lease in guest

[Andrew Overholt]

Hi,

I installed rawhide/F-12 x86_64 (network using NetworkManager) and installed
and started libvirtd.  I then created both F-12 i686 and F-11 i686 guests which
went fine.  However, neither guest is able to acquire a DHCP lease.

Is there some sort of configuration that I didn't do?  I don't recall having to
do anything special with F-11 as a host.  Relevant information below.

I can file a bug if that's preferred.

Thanks,

Andrew

------------------------------------------------------------------------

# virsh net-list --all
Name                 State      Autostart
-----------------------------------------
default              active     yes

# brctl show
bridge name	bridge id		STP enabled	interfaces
virbr0		8000.6e8e6e10bdb6	yes		vnet0
							vnet1

# sysctl net.bridge.bridge-nf-call-iptables
net.bridge.bridge-nf-call-iptables = 1

# iptables -L -v -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
2129K 2744M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          
state RELATED,ESTABLISHED 
    3  1070 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    7   420 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          
state NEW tcp dpt:22 
 2669  335K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          
reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    9  2952 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          
PHYSDEV match --physdev-is-bridged 
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          
reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT 1439K packets, 1128M bytes)
 pkts bytes target     prot opt in     out     source               destination

# ps -ef | grep dnsmasq
nobody    3148     1  0 09:43 ?        00:00:00 /usr/sbin/dnsmasq --strict-order
--bind-interfaces --pid-file=/var/run/libvirt/network/default.pid --conf-file= 
--listen-address 192.168.122.1 --except-interface lo --dhcp-range
192.168.122.2,192.168.122.254
root     20983 20857  0 13:23 pts/5    00:00:00 grep dnsmasq

# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:23:54:9E:57:84  
          inet addr:10.15.16.87  Bcast:10.15.16.255  Mask:255.255.255.0
          inet6 addr: fe80::223:54ff:fe9e:5784/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2414348 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2144264 errors:0 dropped:0 overruns:0 carrier:2
          collisions:0 txqueuelen:1000 
          RX bytes:2888713375 (2.6 GiB)  TX bytes:1065980118 (1016.5 MiB)
          Interrupt:29 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:58553 errors:0 dropped:0 overruns:0 frame:0
          TX packets:58553 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:256208705 (244.3 MiB)  TX bytes:256208705 (244.3 MiB)

virbr0    Link encap:Ethernet  HWaddr 6E:8E:6E:10:BD:B6  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:85 errors:0 dropped:0 overruns:0 frame:0
          TX packets:30 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:19960 (19.4 KiB)  TX bytes:6015 (5.8 KiB)

vnet0     Link encap:Ethernet  HWaddr 6E:8E:6E:10:BD:B6  
          inet6 addr: fe80::6c8e:6eff:fe10:bdb6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3410 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:3204 (3.1 KiB)  TX bytes:180086 (175.8 KiB)

vnet1     Link encap:Ethernet  HWaddr 92:AE:24:5C:77:7E  
          inet6 addr: fe80::90ae:24ff:fe5c:777e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3211 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:3546 (3.4 KiB)  TX bytes:167128 (163.2 KiB)

# cat /proc/sys/net/ipv4/ip_forward
1

I've reloaded the libvirtd service, restarted it, rebooted the guests, etc.

[Mark McLoughlin]

On Thu, 2009-10-29 at 13:25 -0400, Andrew Overholt wrote:
>  Hi,
>  
>  I installed rawhide/F-12 x86_64 (network using NetworkManager) and installed
>  and started libvirtd.  I then created both F-12 i686 and F-11 i686 guests which
>  went fine.  However, neither guest is able to acquire a DHCP lease.
>  
>  Is there some sort of configuration that I didn't do?  I don't recall having to
>  do anything special with F-11 as a host.  Relevant information below.
>  
>  I can file a bug if that's preferred.
>  
>  Thanks,
>  
>  Andrew
>  
>  ------------------------------------------------------------------------
>  
>  # virsh net-list --all
>  Name                 State      Autostart
>  -----------------------------------------
>  default              active     yes
>  
>  # brctl show
>  bridge name	bridge id		STP enabled	interfaces
>  virbr0		8000.6e8e6e10bdb6	yes		vnet0
>  							vnet1
>  
>  # sysctl net.bridge.bridge-nf-call-iptables
>  net.bridge.bridge-nf-call-iptables = 1 
This is supposed to be zero by default in F-12:

  https://bugzilla.redhat.com/512206

>  # iptables -L -v -n
>  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
>   pkts bytes target     prot opt in     out     source               destination         
>  2129K 2744M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          
> state RELATED,ESTABLISHED 
>      3  1070 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
>      7   420 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
>      0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          
> state NEW tcp dpt:22 
>   2669  335K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          
> reject-with icmp-host-prohibited  
Looks like iptables is missing the rules libvirt starts; a 'service
libvirtd reload' should load them again, but you say you've tried that?

Does 'virsh net-destroy default' and 'virsh net-start default' followed
by a restart of the guests help?

Background on libvirt/iptables integration here:

  https://bugzilla.redhat.com/227011

Cheers,
Mark.

[Andrew Overholt]

Hi,

* Mark McLoughlin <markmc(a)redhat.com&gt; [2009-10-29 13:47]:
>  On Thu, 2009-10-29 at 13:25 -0400, Andrew Overholt wrote:
>  > # sysctl net.bridge.bridge-nf-call-iptables
>  > net.bridge.bridge-nf-call-iptables = 1
>  
>  This is supposed to be zero by default in F-12:
>  
>    https://bugzilla.redhat.com/512206 
I've commented.

>  > # iptables -L -v -n
>  > Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
>  >  pkts bytes target     prot opt in     out     source               destination     
>    
>  > 2129K 2744M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0       
>    state RELATED,ESTABLISHED 
>  >     3  1070 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0       
>    
>  >     7   420 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0       
>    
>  >     0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0       
>    state NEW tcp dpt:22 
>  >  2669  335K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0       
>    reject-with icmp-host-prohibited 
>  
>  Looks like iptables is missing the rules libvirt starts; a 'service
>  libvirtd reload' should load them again, but you say you've tried that? 
Yeah, that didn't seem to do anything.  I re-tried it and re-started my
guests but nothing changed.

>  Does 'virsh net-destroy default' and 'virsh net-start
> default' followed
>  by a restart of the guests help? 
Yes, that fixes it.  Is there a bug I should file?

TVM,

Andrew