[openstack-dev] [Neutron] Selectively disabling certain built in iptables rules

2014-01-21 Thread CARVER, PAUL
Feel free to tell me this is a bad idea and scold me for even asking, but please help me figure out how to do it anyway. This is for a specific tenant in a specific lab that was built specifically for that one tenant to do some experimental work that requires VMs to route and other VMs to act

Re: [openstack-dev] [Neutron] Selectively disabling certain built in iptables rules

2014-01-21 Thread Ian Wells
Paul, There's an extension for this that is, I think, presently only implemented by the Nicira plugin. Look for portsecurity. Whatever they do is probably the way you should do it too. Cheers, -- Ian. On 21 January 2014 13:10, CARVER, PAUL pc2...@att.com wrote: Feel free to tell me this

Re: [openstack-dev] [Neutron] Selectively disabling certain built in iptables rules

2014-01-21 Thread Darragh O'Reilly
I think there is a blueprint for that. Anyway, see idea for current releases below: Feel free to tell me this is a bad idea and scold me for even asking, but please help me figure out how to do it anyway. This is for a specific tenant in a specific lab that was built specifically for that

Re: [openstack-dev] [Neutron] Selectively disabling certain built in iptables rules

2014-01-21 Thread Darragh O'Reilly
Darragh O'Reilly wrote: Neutron does not know about flavors or images. But it has ports which have a name attribute that can be set to an arbitrary string, e.g. 'anti_spoof_off'. The name does not need to be unique within the tenant. Then your overridden methods could check for that string.