d3c393ff6b
* Update the URLs affected by the doc-migration (/developer/<project>/ to <project>/latest/) * Follow content rearrangement * Convert links to local documents into :doc: or :ref: * Use https instead of http for the updated links on docs.openstack.org. Part of the doc-migration work. Change-Id: I62e317d9198f175a43d73bbfd419b6878de90d5a
2.2 KiB
Native Open vSwitch firewall driver
Note
Experimental feature or incomplete documentation.
Historically, Open vSwitch (OVS) could not interact directly with
iptables to implement security groups. Thus, the OVS agent and
Compute service use a Linux bridge between each instance (VM) and the
OVS integration bridge br-int to implement security groups.
The Linux bridge device contains the iptables rules pertaining
to the instance. In general, additional components between instances and
physical network infrastructure cause scalability and performance
problems. To alleviate such problems, the OVS agent includes an optional
firewall driver that natively implements security groups as flows in OVS
rather than the Linux bridge device and iptables. This
increases scalability and performance.
Configuring heterogeneous firewall drivers
L2 agents can be configured to use differing firewall drivers. There is no requirement that they all be the same. If an agent lacks a firewall driver configuration, it will default to what is configured on its server. This also means there is no requirement that the server has any firewall driver configured at all, as long as the agents are configured correctly.
Prerequisites
The native OVS firewall implementation requires kernel and user space support for conntrack, thus requiring minimum versions of the Linux kernel and Open vSwitch. All cases require Open vSwitch version 2.5 or newer.
- Kernel version 4.3 or newer includes conntrack support.
- Kernel version 3.3, but less than 4.3, does not include conntrack support and requires building the OVS modules.
Enable the native OVS firewall driver
On nodes running the Open vSwitch agent, edit the
openvswitch_agent.inifile and enable the firewall driver.[securitygroup] firewall_driver = openvswitch
For more information, see the /contributor/internals/openvswitch_firewall and the video.