0

I am trying to understand the differences between two network configurations for MAAS. My understanding is that the both achieve the same tasks where the first network connects to the internet and the second is managed by MAAS. The second network is then configured to forward traffic out via the public network interface.

Despite achieving the same results the configuration looks rather different which is where my confusion lies.

First configuration

The first suggested configuration comes from the following Cloudbase Solutions Wiki page. They propose a simple /etc/network/interfaces with eth0 connecting to an external network and eth1 going to an internal network and being given a static address:

# The primary network interface (external)
auto eth0
iface eth0 inet dhcp

# The secondary NIC (used internal for MAAS)
auto eth1
iface eth1 inet static
address 192.168.1.1
netmask 255.255.255.0

The corresponding iptables rules are then held in /etc/rc.local. As far as I can tell this has something to do with the forwarding of network traffic between eth1 and eth0.

/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Second configuration

The second configuration comes from the Ubuntu Openstack Installer for Multi Installer Guide. Their /etc/network/interfaces file has more network interfaces but is similar to the previous configuration where eth0 connects to an external network and eth1 is internal:

# The loopback network interface
auto lo
iface lo inet loopback
  dns-nameservers 127.0.0.1
  pre-up iptables-restore < /etc/network/iptables.rules

auto eth0
iface eth0 inet dhcp

auto eth1
iface eth1 inet manual

auto br0
iface br0 inet static
  address 172.16.0.1
  netmask 255.255.255.0
  bridge_ports eth1

Questions that pop to my head at this stage are why does the lo have a DNS Name Server and iptables applied to it? Why is a bridged connection used in this instance?

Their iptable rules also look different and are placed in /etc/network/iptables.rules and assume this enables the forwarding of traffic:

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 172.16.0.1/24 ! -d 172.16.0.1/24 -j MASQUERADE
COMMIT

Summary

Can someone help explain what they are doing differently and why?

Let me know if this question is too big and I can chunk it down to separate questions but in the first instance I thought this provided more context.

1

Both configurations are pretty much the same with some nuances.

iface lo inet loopback
  dns-nameservers 127.0.0.1
  pre-up iptables-restore < /etc/network/iptables.rules

This configuration will guarantee that even if your eth0 cable is off while booting, you will still have a DNS resolver and firewall rules set (it's difficult to get rid of loopback network device right?). Off course this example presumes that you will have a running DNS resolver service locally.

I do not see any problems with setting a bridge device. This configuration should work without a problem, but don't really think you need it in your case, unless you are planning something that is going to use it (KVM virtual machines, for example).

In the first case iptables rules are written for a shell script that's why their syntax looks different from /etc/network/iptables.rules which should be used with iptables-restore.

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 172.16.0.1/24 ! -d 172.16.0.1/24 -j MASQUERADE
COMMIT

There's only one rule here and it allows 172.16.0.0/24 subnet to be masqueraded.

/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Rules above allows any subnet coming from eth1 through eth0 to be masqueraded with some filtering involved.

Personally I would rather go with a mix of configurations above.

1

The first network configuration is pretty clear. The /etc/network/interfaces file is familiar to everyone and of course IP forwarding through iptables is need while using MAAS, to provide internet to nodes that are being managed by MAAS.

The second configuration other than the DNS part and the br0 part is understandable. The DNS part is to actually make the MAAS server realize that it itself is hosting the DNS services. That line may be shifted to /etc/resolve.conf which includes other DNS configurations. If this DNS entry is not made you will reach this error during JUJU bootstrap: https://github.com/Ubuntu-Solutions-Engineering/openstack-installer/issues/901

However, I am not really sure about the bridge br0. Did this network configuration actually work?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.