weizhouapache commented on pull request #5397: URL: https://github.com/apache/cloudstack/pull/5397#issuecomment-920752423
@ravening can you add egress rules in ACL of vm tiers? does vm have static nat IP ? > @weizhouapache > > inbound > > ``` > # iptables-save | grep ACL_INBOUND > :ACL_INBOUND_eth2 - [0:0] > :ACL_INBOUND_eth3 - [0:0] > :ACL_INBOUND_eth4 - [0:0] > :ACL_INBOUND_eth5 - [0:0] > :ACL_INBOUND_eth6 - [0:0] > -A FORWARD -s 10.32.22.96/27 -d 10.69.0.0/24 -j ACL_INBOUND_eth3 > -A FORWARD -s 10.69.0.0/24 -d 10.32.22.96/27 -j ACL_INBOUND_eth2 > -A FORWARD -s 10.32.22.96/27 -d 10.69.1.0/24 -j ACL_INBOUND_eth4 > -A FORWARD -s 10.69.1.0/24 -d 10.32.22.96/27 -j ACL_INBOUND_eth2 > -A FORWARD -s 10.32.22.96/27 -d 10.69.2.0/24 -j ACL_INBOUND_eth5 > -A FORWARD -s 10.69.2.0/24 -d 10.32.22.96/27 -j ACL_INBOUND_eth2 > -A FORWARD -s 10.32.22.96/27 -d 10.69.3.0/24 -j ACL_INBOUND_eth6 > -A FORWARD -s 10.69.3.0/24 -d 10.32.22.96/27 -j ACL_INBOUND_eth2 > -A FORWARD -d 10.32.22.96/27 -o eth2 -j ACL_INBOUND_eth2 > -A FORWARD -d 10.69.0.0/24 -o eth3 -j ACL_INBOUND_eth3 > -A FORWARD -d 10.69.1.0/24 -o eth4 -j ACL_INBOUND_eth4 > -A FORWARD -d 10.69.2.0/24 -o eth5 -j ACL_INBOUND_eth5 > -A FORWARD -d 10.69.3.0/24 -o eth6 -j ACL_INBOUND_eth6 > -A ACL_INBOUND_eth2 -p icmp -m icmp --icmp-type any -j ACCEPT > -A ACL_INBOUND_eth2 -s 66.55.152.67/32 -p tcp -m tcp --dport 22002 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 3389 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 1433 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 111 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 9090 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 139 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 145 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 5900:5910 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.3.0/24 -p tcp -m tcp --dport 873 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 1433 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 111 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 139 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 445 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 10933 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/24 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/24 -p tcp -m tcp --dport 111 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/24 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/16 -p tcp -m tcp --dport 8086 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 3306 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 873 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 8086 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 1433 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 22001 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 22002 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.0.0.0/16 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.32.22.96/27 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.2.0/24 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.0.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.1.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.69.2.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth2 -s 10.32.22.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth2 -s 52.2.55.172/32 -p tcp -m tcp --dport 22001 -j ACCEPT > -A ACL_INBOUND_eth2 -j DROP > -A ACL_INBOUND_eth2 -j DROP > -A ACL_INBOUND_eth3 -d 225.0.0.50/32 -j ACCEPT > -A ACL_INBOUND_eth3 -d 224.0.0.18/32 -j ACCEPT > -A ACL_INBOUND_eth3 -p icmp -m icmp --icmp-type any -j ACCEPT > -A ACL_INBOUND_eth3 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth3 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth3 -p tcp -m tcp --dport 3000 -j ACCEPT > -A ACL_INBOUND_eth3 -p tcp -m tcp --dport 4443 -j ACCEPT > -A ACL_INBOUND_eth3 -p udp -m udp --dport 10000 -j ACCEPT > -A ACL_INBOUND_eth3 -p tcp -m tcp --dport 25 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 3389 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 9090 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 7999 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 7990 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 8095 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 8080 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 8090 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 8050 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.69.3.0/24 -p tcp -m tcp --dport 8051 -j ACCEPT > -A ACL_INBOUND_eth3 -s 10.0.0.0/16 -p tcp -m tcp --dport 10933 -j ACCEPT > -A ACL_INBOUND_eth3 -j DROP > -A ACL_INBOUND_eth3 -j DROP > -A ACL_INBOUND_eth4 -d 225.0.0.50/32 -j ACCEPT > -A ACL_INBOUND_eth4 -d 224.0.0.18/32 -j ACCEPT > -A ACL_INBOUND_eth4 -p icmp -m icmp --icmp-type any -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.3.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.3.0/24 -p tcp -m tcp --dport 3389 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.3.0/24 -p tcp -m tcp --dport 873 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.3.0/24 -p tcp -m tcp --dport 9090 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.3.0/24 -p tcp -m tcp --dport 5000 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 3000 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 8095 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 8080 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 8090 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 7990 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 8050 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 8051 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 7999 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.69.0.0/16 -p tcp -m tcp --dport 25 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.0.0.0/16 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth4 -s 10.0.0.0/16 -p tcp -m tcp --dport 8095 -j ACCEPT > -A ACL_INBOUND_eth4 -j DROP > -A ACL_INBOUND_eth4 -j DROP > -A ACL_INBOUND_eth5 -d 225.0.0.50/32 -j ACCEPT > -A ACL_INBOUND_eth5 -d 224.0.0.18/32 -j ACCEPT > -A ACL_INBOUND_eth5 -p icmp -m icmp --icmp-type any -j ACCEPT > -A ACL_INBOUND_eth5 -s 66.55.152.67/32 -p tcp -m tcp --dport 22002 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 3389 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 1433 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 111 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 9090 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 139 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 145 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 5900:5910 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.3.0/24 -p tcp -m tcp --dport 873 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 1433 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 111 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 139 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 445 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 6379 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 10933 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/24 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/24 -p tcp -m tcp --dport 111 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/24 -p tcp -m tcp --dport 2049 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/24 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/24 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/16 -p tcp -m tcp --dport 8086 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 3306 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 873 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 8086 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 1433 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 22001 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 22002 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 9000 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.0.0.0/16 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.32.22.96/27 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.2.0/24 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.0.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.1.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.69.2.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth5 -s 10.32.22.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth5 -s 52.2.55.172/32 -p tcp -m tcp --dport 22001 -j ACCEPT > -A ACL_INBOUND_eth5 -j DROP > -A ACL_INBOUND_eth5 -j DROP > -A ACL_INBOUND_eth6 -d 225.0.0.50/32 -j ACCEPT > -A ACL_INBOUND_eth6 -d 224.0.0.18/32 -j ACCEPT > -A ACL_INBOUND_eth6 -p icmp -m icmp --icmp-type any -j ACCEPT > -A ACL_INBOUND_eth6 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_INBOUND_eth6 -p tcp -m tcp --dport 80 -j ACCEPT > -A ACL_INBOUND_eth6 -p tcp -m tcp --dport 443 -j ACCEPT > -A ACL_INBOUND_eth6 -p tcp -m tcp --dport 943 -j ACCEPT > -A ACL_INBOUND_eth6 -p udp -m udp --dport 1194 -j ACCEPT > -A ACL_INBOUND_eth6 -j DROP > -A ACL_INBOUND_eth6 -j DROP > ``` > > outbound > > ``` > # iptables-save | grep ACL_OUTBOUND > :ACL_OUTBOUND_eth3 - [0:0] > :ACL_OUTBOUND_eth4 - [0:0] > :ACL_OUTBOUND_eth5 - [0:0] > :ACL_OUTBOUND_eth6 - [0:0] > :ACL_OUTBOUND_eth2 - [0:0] > -A PREROUTING -s 10.69.0.0/24 ! -d 10.69.0.254/32 -i eth3 -m state --state NEW -j ACL_OUTBOUND_eth3 > -A PREROUTING -s 10.69.1.0/24 ! -d 10.69.1.254/32 -i eth4 -m state --state NEW -j ACL_OUTBOUND_eth4 > -A PREROUTING -s 10.69.2.0/24 ! -d 10.69.2.254/32 -i eth5 -m state --state NEW -j ACL_OUTBOUND_eth5 > -A PREROUTING -s 10.69.3.0/24 ! -d 10.69.3.254/32 -i eth6 -m state --state NEW -j ACL_OUTBOUND_eth6 > -A PREROUTING -s 10.32.22.96/27 ! -d 10.32.22.125/32 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2 > -A ACL_OUTBOUND_eth3 -d 224.0.0.18/32 -j ACCEPT > -A ACL_OUTBOUND_eth3 -d 225.0.0.50/32 -j ACCEPT > -A ACL_OUTBOUND_eth4 -d 224.0.0.18/32 -j ACCEPT > -A ACL_OUTBOUND_eth4 -d 225.0.0.50/32 -j ACCEPT > -A ACL_OUTBOUND_eth5 -d 224.0.0.18/32 -j ACCEPT > -A ACL_OUTBOUND_eth5 -d 10.32.22.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > -A ACL_OUTBOUND_eth5 -d 225.0.0.50/32 -j ACCEPT > -A ACL_OUTBOUND_eth6 -d 224.0.0.18/32 -j ACCEPT > -A ACL_OUTBOUND_eth6 -d 225.0.0.50/32 -j ACCEPT > -A ACL_OUTBOUND_eth2 -d 10.32.22.0/24 -p tcp -m tcp --dport 22 -j ACCEPT > ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
