weizhouapache commented on PR #13684: URL: https://github.com/apache/cloudstack/pull/13684#issuecomment-5197252656
> @weizhouapache thing that there is a misunderstanding here: from what I know (worth testing....) the default DENY rule applies only until someone adds a very first egress rule (any) - after that - if they want to allow just some outgoing/egress traffic and notall, there is no more "default/failback" DENY rule exising, it has to be explicitly added. afaik, if egress policy is DENY, the REJECT rule is always the last rule in the iptables chain, the other rules in the chain are ACCEPT-ed. Similarly, if egress policy is ALLOW, the ACCEPT rule is the last while other rules are REJECT-ed. I will test tomorrow. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
