[Architectural] SystemVMs using public DNS server

[daniftodi]

This might be a configuration issue but I'm pretty new in this area so I will ask it.
Worth mentioning that I use the Basic network configuration.

I observe that SystemVMs are created using the public DNS server configured on the Zone.

This is all fine but it causes problems in a setup that has a private DNS server and storage hosts are using names (ex: storage1.lan).

I think SystemVMs are responsible for executing Commands, and the Download System Image is a command executed by them, they are not able to resolve the host name because of the public DNS server.

Shouldn't SystemVMs be created with the configured Internal DNS?

[DaanHoogland]

@daniftodi is the problem that the DNS at 10.1.0.1 does not have information (A or CNAME) on 'storage1.lan'?

I'd have to look at an env, I don't think the fact that it is a basic zone matters in this case.

Is your systemvm image available and the ssvm started?

[daniftodi]

Version: 4.2.0.0

What I observed so far:

• It is missing a default route, it doesn't have access to the internet by default, is this ok?

In order to be able to download templates I added a default route manually, how can I make it permanent?

ip route show
default via 10.1.0.1 dev eth1 
10.1.0.0/24 dev eth1 proto kernel scope link src 10.1.0.145 
169.254.0.0/16 dev eth0 proto kernel scope link src 169.254.185.27

• Storage VM is dropping output http and https traffic?

iptables -L OUTPUT -v -n
Chain OUTPUT (policy ACCEPT 1280 packets, 197K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    7   364 REJECT     6    --  *      eth1    0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80 reject-with icmp-port-unreachable
    4   208 REJECT     6    --  *      eth1    0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443 reject-with icmp-port-unreachable

• Even in documentation it is specified that port 3922 can be used to connect to instances using ssh, the ssh service is disabled by default.

[rajujith]

@daniftodi Unless you have specific reasons it is better to use an Advanced zone. In a Basic zone, the guest network is assigned to the SSVM expecting that the internet is accessible through that network or it is a public network itself.

[DaanHoogland]

@daniftodi , did you try installing an advanced zone, as @rajujith suggested?

[daniftodi]

I didn't experiment anymore, I have created an advanced zone and I'm using my private dns as a public and as a private DNS.