<div dir="ltr">Yes, right, but why can't use floating ip? Administrator or user should care the floating ip for instance rather fix ip. So i think firewall also take effect about floating ip.<div><br></div><div>Thanks,</div>
<div>Xurong Yang </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-06-05 19:32 GMT+08:00 ZZelle <span dir="ltr"><<a href="mailto:zzelle@gmail.com" target="_blank">zzelle@gmail.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div>Hi,<br><br></div>When the router receives packets from the external network, iptables does sequentially:<br>
</div> 1) NAT PREROUTING table: translate floatingip to fixed ip<br>
</div> 2) FILTER FORWARD table: apply FW rules ... on fixed ips because floatingip has been translated to fixed ip<br><br><br></div>So disabling the ping to the floatingip has no effect, you should instead disable ping to associated fixed ip.<br>
<br><br></div>More generally in (iptables) FW rules, you should use fixed-ips/cidrs as source/target not floatingips<br><br><br></div>Cheers,<br><br></div>Cedric<br><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">
<div><div class="h5">
On Thu, Jun 5, 2014 at 1:15 PM, Xurong Yang <span dir="ltr"><<a href="mailto:idopra@gmail.com" target="_blank">idopra@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div class="h5">
<div dir="ltr"><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">Hi, Stackers,</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">
Use case description:</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">Firewal is not working when setting the destination-ip-address as VM's floating ip<br>
Steps to Reproduce:<br>1. create one network and attached it to the newly created router<br>2. Create VMs on the above network<br>3. create security group rule for icmp<br>4. create an external network and attach it to the router as gateway<br>
5. create floating ip and associate it to the VMs<br>6. create a first firewall rule as protocol=icmp , action =deny and desitination-ip-address as floatingip<br>7. create second firewall rule as protocol=any action=allow<br>
8. attach the rule to the policy and the policy to the firewall<br>9. ping the VMs floating ip from network node which is having the external network configured.</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">
Actual Results:<br>Ping succeeds</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">Expected Results:<br>
Ping should fail as per the firewall rule</p><p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">
router's functionality both NAT and Firewall, so , although we have created firewall rule, DNAT will take action(change floating ip to fix ip) in PREROUTING chain preferentially when network node ping vm's floating ip, so firewall rules in FORWARD chain couldn't match because packet's ip has been changed to fix ip.</p>
<p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">additional case:<br>if we change firewall rule protocol=icmp , action =deny and desitination-ip-address as fix ip, ping fail.</p>
<p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">in short , router firewall can't take effect about floating ip.</p><p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">
what do you think?</p><p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">Cheers,</p><p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">
Xurong Yang</p><p style="margin:0px 0px 0.8em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px"><br></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:monospace;font-size:12px;line-height:18px">
<br></p></div>
<br></div></div>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>