⁠Chapter 14. Proxies

14.1. SPICE Proxy
14.2. Squid Proxy

⁠14.1. SPICE Proxy

14.1.1. SPICE Proxy Overview
14.1.2. SPICE Proxy Machine Setup
14.1.3. Turning on SPICE Proxy
14.1.4. Turning Off a SPICE Proxy

⁠14.1.1. SPICE Proxy Overview

The SPICE Proxy is a tool used to connect SPICE Clients to virtual machines when the SPICE Clients are outside the network that connects the hypervisors. Setting up a SPICE Proxy consists of installing Squid on a machine and configuring iptables to allow proxy traffic through the firewall. Turning a SPICE Proxy on consists of using engine-config on the Manager to set the key SpiceProxyDefault to a value consisting of the name and port of the proxy. Turning a SPICE Proxy off consists of using engine-config on the Manager to remove the value to which the key SpiceProxyDefault has been set.

Important

The SPICE Proxy can only be used in conjunction with the standalone SPICE client, and cannot be used to connect to virtual machines using SPICE HTML5 or noVNC.

⁠14.1.2. SPICE Proxy Machine Setup

Summary
This procedure explains how to set up a machine as a SPICE Proxy. A SPICE Proxy makes it possible to connect to the Red Hat Enterprise Virtualization network from outside the network. We use Squid in this procedure to provide proxy services.
⁠

Procedure 14.1. Installing Squid on Red Hat Enterprise Linux

  1. Install Squid on the Proxy machine: 
    # yum install squid
  2. Open /etc/squid/squid.conf. Change: 
    http_access deny CONNECT !SSL_ports
    to: 
    http_access deny CONNECT !Safe_ports
  3. Restart the proxy: 
    # service squid restart
  4. Open the default squid port: 
    # iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
  5. Make this iptables rule persistent: 
    # service iptables save
Result
You have now set up a machine as a SPICE proxy. Before connecting to the Red Hat Enterprise Virtualization network from outside the network, activate the SPICE proxy.

⁠14.1.3. Turning on SPICE Proxy

Summary
This procedure explains how to activate (or turn on) the SPICE proxy.
⁠

Procedure 14.2. Activating SPICE Proxy

  1. On the Manager, use the engine-config tool to set a proxy: 
    # engine-config -s SpiceProxyDefault=someProxy
  2. Restart the ovirt-engine service: 
    # service ovirt-engine restart
    The proxy must have this form: 
    protocol://[host]:[port]

    Note

    Only the HTTP protocol is supported by SPICE clients. If HTTPS is specified, the client will ignore the proxy setting and attempt a direct connection to the hypervisor.
Result
SPICE Proxy is now activated (turned on). It is now possible to connect to the Red Hat Enterprise Virtualization network through the SPICE proxy.

⁠14.1.4. Turning Off a SPICE Proxy

Summary
This procedure explains how to turn off (deactivate) a SPICE proxy.
⁠

Procedure 14.3. Turning Off a SPICE Proxy

  1. Log in to the Manager: 
    $ ssh root@[IP of Manager]
  2. Run the following command to clear the SPICE proxy: 
    # engine-config -s SpiceProxyDefault=""
  3. Restart the Manager: 
    # service ovirt-engine restart
Result
SPICE proxy is now deactivated (turned off). It is no longer possible to connect to the Red Hat Enterprise Virtualization network through the SPICE proxy.