I am running KVM hosts using Open vSwitch for networking. I am having trouble giving VM’s public network access via Open vSwitch. I currently do not have a cable in my other NIC, and for that reason I cannot create a bridge on my only public network connection.
Here are the steps that I took to set up the public network:
looks like you need to add the physical interface that is wired as a bridge slave. not sure the syntax for the ifcfg file but you want something like this in the end:
ovs-vsctl show
ebc2ef44-4a77-4c77-a4fc-a170c2769d65
Bridge "ovsbr0"
Port "enp3s0f0"
Interface "enp3s0f0"
Port "ovsbr0"
Interface "ovsbr0"
type: internal
ovs_version: "2.5.0"
ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp3s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 1000
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet6 fe80::225:90ff:fe13:8ce6/64 scope link
valid_lft forever preferred_lft forever
...
4: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
link/ether 7e:dc:40:3c:12:ad brd ff:ff:ff:ff:ff:ff
5: ovsbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 10.1.1.2/24 brd 10.1.1.255 scope global dynamic ovsbr0
valid_lft 57848sec preferred_lft 57848sec
inet6 fe80::225:90ff:fe13:8ce6/64 scope link
valid_lft forever preferred_lft forever
Since I have a single NIC for use here, I would lose connectivity if I were to use my public interface as the bridge slave. Is there any way around this that you know of?
I will certainly try this suggestion again. However, I have tried it before. I lose network connectivity on the host, as is expected, but I do not gain external network connectivity on the VM. The only thing that changes is that the hosts are able to ping the VM IP. I expect that this means that using the public interface as the bridge slave is the correct configuration, but it still doesn’t completely solve the problem.
If like in my example you put the IP address on the bridge interface then the host still gets ip connectivity to the network I didn’t look at your screen cap that closely. but I suspect that your ip is still on ens3 becaue you didn’t specify any bridge slaves in the ifcfg file.
I use openvswitch to do exactly what you want, but I don’t use that ifcfg file so i’m not exactly sure what the syntax needs to be. but as a test flush the ip off of ens3, add it to the bridge, and then add an ip to br0. it’ll work for you.
I have a KVM host with a single NIC connected to the network, and 3 OVS bridges, only one is “connected” to Internet.
ovs-vsctl show:
Bridge "br0"
Port "br0"
Interface "br0"
type: internal
Port "one-24-0"
Interface "one-24-0"
Port "one-12-1"
Interface "one-12-1"
Port "one-22-1"
Interface "one-22-1"
Port "eth0"
Interface "eth0"
Port "one-26-0"
Interface "one-26-0"
Port "one-29-0"
Interface "one-29-0"
As you can see, eth0 is present.
And my network configuration is done like:
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 1000
link/ether 14:02:ec:43:33:98 brd ff:ff:ff:ff:ff:ff
inet6 fe80::1602:ecff:fe43:3398/64 scope link
valid_lft forever preferred_lft forever
[...]
7: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 14:02:ec:43:33:98 brd ff:ff:ff:ff:ff:ff
inet 172.16.0.1/16 brd 172.16.255.255 scope global br0
valid_lft forever preferred_lft forever
inet6 fe80::1602:ecff:fe43:3398/64 scope link
valid_lft forever preferred_lft forever
And it is working like a charm
I think your problem is now that your VM nic is not set into the bridge.
So that, network connectivity is lost, as (un)expected…
Try to add manually the port of the VM (it should not be ens3, no ? something like one-xx-0 ?)
Does your host have internet connectivity (e.g. ping google.com)?
I have pretty much copied your exact configuration, changing IP addresses of course, and I still have no external connectivity on my host. Haven’t tried creating a VM yet.
I’m beginning to think there is something else that is wrong, not just the network/ovs config…
Does eth0 (or the real physical NIC name) belongs to br0 ?
Can you post ovs-vsctl show br0 ?
Can you reach using arping your gw using ANY of the present interface ?
I’ll post my config in my next reply as I’m away from my notes atm.
What worked for me was a simpler approach with the config, do you only have 1 Nic or multiple?
Part of the solution after compiling ovs was to disable firewalld and reboot the host, with the simpler config this action helped me get ovs running.
I’m using 2 Nic solution.
1 Nic - management
1 Nic - Public
The physical Nic 2 has no public access.
The management Nic 1 allows for public ingress via our internal GW only.
Keeping the 2 networks seperate helps isolate traffic and in the event of Nic issues we can still have management access.
you should end up with the following after reboot and adding a VM via sunstone to a OVS backed network set to manual or Auto vLAN:
# ovs-vsctl show
cc64ecf1-33db-423a-a474-ea4367473fed
Bridge "br0"
Port "enp4s0f0"
Interface "enp4s0f0"
Port "br0"
Interface "br0"
type: internal
Port "one-6-0"
tag: 10
Interface "one-6-0"
Port "one-5-0"
tag: 10
Interface "one-5-0"
ovs_version: "2.5.5"
Something to keep in mind would be if you want the VM’s to reach public access via the same vLAN would be that the switch ports are tagged with the appropriate vLAN’s and can reach public internet.
Thanks for your answer… I did the same as you but still the VM are no able to reach Internet, I did a ping from VM to Internet, but the VM cannot reach the GW. Could you take a look in my post OpenNebula + KVM + Open VSwitch I include more details…
im not a OVS expert by any stretch of the imagination and can only advise what is working for me.
When looking at your config for Br0 and eno1 they have a lot more content in them than my posted solution.
again not an expert here but if its currently not working just copy and paste in my config and make small changes to reflect eno1.
Reboot the host.
make sure in Sunstone > Network > network name xxx > set to open vSwitch > make sure there is a GW defined in the IP delegation section.
Add this to a VM
test.
Once you have it working on the clean config as per the previous posted example then playing with changes incrementally will let you know what works and doesn’t work.
Is your internet on a dedicated vLAN or is it open and untagged?
If your internet is untagged then adding a vLAN to a VM will mean that its isolated and wont be able to reach the public internet.
Maybe someone with more knowledge on the subject can chime in.
Sorry for my late answer, I did the changes that you suggest me, also I want to comment you that Im using just one NIC on the physical server, the configuration about the OVS Bridge works fine the physical machine can reach internet thru OVS Bridge,
about your comments… This part is not complety clear for me, why? because from my VM a can’t reach the GW.
make sure in Sunstone > Network > network name xxx > set to open vSwitch > make sure there is a GW defined in the IP delegation section.
