It’s a fairly common issue for OpenStack users to be unable to connect to newly created VM’s via SSH after creation. This can be due to security groups, or it can be caused by using the incorrect virtual router. In the following article, I will go through several troubleshooting steps to help you connect to VM instances in an OpenStack environment.
The first thing you will want to verify is that the security group your instance is connected to allows both ICMP & SSH traffic. To list out current groups, run the following command:
# nova secgroup-list
Most OpenStack environments will have a “default” security group that attaches to all newly created instances. The “default” security group does not allow ping or SSH connectivity but you can add it either through the Horizon dashboard, or with NovaCLI, as demonstrated below.
This will allow ping access to an instance from anywhere:
nova secgroup-add-rule default icmp -1 -1 0.0.0.0/0
nova secgroup-add-rule default tcp 22 22 0.0.0.0/0
This should print out the DHCP & router namespaces living in your environment, as shown below.
ip netns exec qrouter-[UUID] ip address
Which should give an output similar to the screenshot below.
ip netns exec qrouter-[UUID] ssh firstname.lastname@example.org
ip netns exec qrouter-[UUID] bash