[
https://issues.apache.org/jira/browse/CLOUDSTACK-3129?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Kishan Kavala resolved CLOUDSTACK-3129.
---------------------------------------
Resolution: Fixed
Default behavior is not changed from 4.1.
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Inter-VLAN+Routing
"By default, all incoming traffic to guest networks is blocked. To open the
ports, new network ACL has to be created. Network ACLs can be created for the
Guest networks only when NetworkACL service is supported.
all outgoing traffic from guest networks is allowed, once you add an ACL rule
for outgoing traffic, then only outgoing traffic specified in this ACL rule is
allowed, the rest is blocked"
I've updated spec
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Support+ACL+deny+rules
to reflect the above behavior.
> NTier: All Outgoing Traffic between Tiers and various gateways/tiers is
> currently allowed by default contrary to behavior mentioned in the Design
> Document
> ----------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CLOUDSTACK-3129
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-3129
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: Management Server
> Affects Versions: 4.2.0
> Reporter: Chandan Purushothama
> Assignee: Kishan Kavala
> Priority: Critical
> Fix For: 4.2.0
>
>
> ======================
> On The VPC Virtual Router:
> ======================
> root@r-3-NTIERAGN:~# iptables-save | grep ACL
> :ACL_OUTBOUND_eth2 - [0:0]
> :ACL_OUTBOUND_eth3 - [0:0]
> -A PREROUTING -s 192.168.10.0/24 ! -d 192.168.10.1/32 -i eth3 -m state
> --state NEW -j ACL_OUTBOUND_eth3
> -A PREROUTING -s 192.168.11.0/24 ! -d 192.168.11.1/32 -i eth2 -m state
> --state NEW -j ACL_OUTBOUND_eth2
> -A ACL_OUTBOUND_eth2 -j ACCEPT
> -A ACL_OUTBOUND_eth3 -j ACCEPT
> :ACL_INBOUND_eth2 - [0:0]
> :ACL_INBOUND_eth3 - [0:0]
> -A FORWARD -d 192.168.10.0/24 -o eth3 -j ACL_INBOUND_eth3
> -A FORWARD -d 192.168.11.0/24 -o eth2 -j ACL_INBOUND_eth2
> -A ACL_INBOUND_eth2 -j DROP
> -A ACL_INBOUND_eth3 -j DROP
> root@r-3-NTIERAGN:~#
> ========================
> Network Information of eth3 NIC:
> ========================
> mysql> select * from networks where id=208 \G
> *************************** 1. row ***************************
> id: 208
> name: Atoms-VPC-Net-2
> uuid: c81066f7-f3ed-4aab-8f86-be8d3bab32ed
> display_text: Atoms-VPC-Net-2
> traffic_type: Guest
> broadcast_domain_type: Vlan
> broadcast_uri: vlan://2580
> gateway: 192.168.11.1
> cidr: 192.168.11.0/24
> mode: Dhcp
> network_offering_id: 12
> physical_network_id: 200
> data_center_id: 1
> guru_name: ExternalGuestNetworkGuru
> state: Implemented
> related: 208
> domain_id: 1
> account_id: 3
> dns1: NULL
> dns2: NULL
> guru_data: NULL
> set_fields: 0
> acl_type: Account
> network_domain: atomsvpcnet1.lab.vmops.com
> reservation_id: 175f7abb-a55b-4932-b394-24137ee1203b
> guest_type: Isolated
> restart_required: 0
> created: 2013-06-21 21:24:45
> removed: NULL
> specify_ip_ranges: 0
> vpc_id: 1
> ip6_gateway: NULL
> ip6_cidr: NULL
> network_cidr: NULL
> display_network: 1
> network_acl_id: NULL
> 1 row in set (0.00 sec)
> mysql>
> ==============================================================
> As per the FS at
> https://cwiki.apache.org/CLOUDSTACK/support-acl-deny-rules.html:
> ==============================================================
> ACL Deny Rules
> Currently only ACL allow rules are supported as part of Network ACLs. Default
> is to block all incoming and all outgoing traffic between tiers and between
> tiers and various gateways (including Public). ACL deny rules will be
> supported through this feature. New fields "number" and "action"will be
> added to rules to resolve conflicting rules.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
