OpenStack虚拟机无法连接（ping通）外部网络问题排查(2)

1、问题

部署好OpenStack后，按照
OpenStack虚拟机无法连接（ping通）外部网络问题排查
帖子的步骤，配置好宿主机的转发规则后，依然无法实现ping通外部网络

2、解决问题

2.1、检查已有配置

已有配置都已经按转发要求配置好

# cat /proc/sys/net/ipv4/ip_forward
1

# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  anywhere            !loopback/8           ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  172.17.0.0/16        anywhere
MASQUERADE  tcp  --  172.17.0.2           172.17.0.2           tcp dpt:commplex-main
MASQUERADE  all  --  192.168.100.0/24     anywhere

Chain DOCKER (2 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere
DNAT       tcp  --  anywhere             anywhere             tcp dpt:50500 

2.2、查看iptables规则

查看iptables规则发现，FORWARD策略默认为DROP

# iptables -nL
Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

2.3、修改FORWARD默认策略

将FORWARD默认策略改为ACCEPT后，虚拟机就可以ping通外部网络了

# iptables -P FORWARD ACCEPT