Damans227 commented on PR #14357: URL: https://github.com/apache/cloudstack/pull/14357#issuecomment-6273595601
tested on kvm (ol8 host, advanced zone) with packages built from this PR. made a vpc with one tier, a custom acl list and one vm, then checked the router rules after each step. all cases pass. - protocol 6, port 22: `-p tcp -m tcp --dport 22 -j ACCEPT` - protocol 17, port 53: `-p udp -m udp --dport 53 -j ACCEPT` - protocol 6, no ports: `-p tcp -j ACCEPT` - protocol ICMP, type 8 code 0: `-p icmp -m icmp --icmp-type 8/0 -j ACCEPT` - same rule updated to protocol 1, type 8: `-p icmp -m icmp --icmp-type 8 -j ACCEPT` - egress protocol 6, port 443: `-p tcp -m tcp --dport 443 -j ACCEPT` - protocol 132 with ports is refused: `Start and end port can only be given for TCP or UDP (protocol number 6 or 17), not for protocol number [132]` - rebooted the router, all rules above came back the same router rules after the reboot: ``` -A ACL_INBOUND_eth2 -p tcp -m tcp --dport 22 -j ACCEPT -A ACL_INBOUND_eth2 -p udp -m udp --dport 53 -j ACCEPT -A ACL_INBOUND_eth2 -p tcp -j ACCEPT -A ACL_INBOUND_eth2 -p icmp -m icmp --icmp-type 8 -j ACCEPT -A ACL_INBOUND_eth2 -j DROP -A ACL_OUTBOUND_eth2 -p tcp -m tcp --dport 443 -j ACCEPT ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
