<div dir="ltr">Hi Miyashita,<div><br></div><div>The second rule is 'accept' on state being 'established' or 'related'. In case of ICMP, if a request has gone out from inside network, then the reply to that will match this rule. A new ICMP message initiated from outside will not match this rule.</div><div><br></div><div>I hope I understood your question correctly. Let me know if this addresses your concern.</div><div><br></div><div>Thanks,</div><div>-Rajesh Mohan</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 30, 2015 at 1:58 AM, Miyashita, Kazuhiro <span dir="ltr"><<a href="mailto:miyakz@jp.fujitsu.com" target="_blank">miyakz@jp.fujitsu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="JA" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">Hi,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">I want to ask about FWaaS iptables rule implementation.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">firewall rule are deployed as iptables rules in network node , and ACCEPT target is set at second rule(*).<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">----<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">Chain neutron-l3-agent-iv431d7bfbc (1 references)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">pkts bytes target prot opt in out source destination<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 DROP all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state INVALID<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 ACCEPT all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state RELATED,ESTABLISHED (*)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 neutron-l3-agent-liA31d7bfbc tcp -- * * <a href="http://172.16.2.0/23" target="_blank">172.16.2.0/23</a> 1.2.3.4 tcp spts:1025:65535 dpt:80</span><span style="font-size:10.0pt;font-family:"\00ff2d\00ff33 \0030b4\0030b7\0030c3\0030af""> </span><span lang="EN-US" style="font-size:10.0pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 neutron-l3-agent-liA31d7bfbc tcp -- * * <a href="http://172.16.6.0/24" target="_blank">172.16.6.0/24</a> 1.2.3.4 tcp spts:1025:65535 dpt:80</span><span style="font-size:10.0pt;font-family:"\00ff2d\00ff33 \0030b4\0030b7\0030c3\0030af""> </span><span lang="EN-US" style="font-size:10.0pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 neutron-l3-agent-liA31d7bfbc tcp -- * * 1.2.3.4 <a href="http://172.16.14.0/24" target="_blank">172.16.14.0/24</a> tcp spts:1025:65535 dpt:11051</span><span style="font-size:10.0pt;font-family:"\00ff2d\00ff33 \0030b4\0030b7\0030c3\0030af""> </span><span lang="EN-US" style="font-size:10.0pt">
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 neutron-l3-agent-liA31d7bfbc tcp -- * * <a href="http://10.3.0.0/24" target="_blank">10.3.0.0/24</a> 1.2.3.4 tcp spts:1025:65535 dpt:22</span><span style="font-size:10.0pt;font-family:"\00ff2d\00ff33 \0030b4\0030b7\0030c3\0030af""> </span><span lang="EN-US" style="font-size:10.0pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"> 0 0 neutron-l3-agent-liD31d7bfbc all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></span><span style="font-size:10.0pt;font-family:"\00ff2d\00ff33 \0030b4\0030b7\0030c3\0030af""> </span><span lang="EN-US" style="font-size:10.0pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">----<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">Why is ACCEPT rule set at second in iptables rule. Performance reason(ICMP or other protocol such as UDP/TCP)?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">This causes some wrong scenario for example...<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">[outside openstack cloud] ---> Firewall(FWaaS) --> [inside openstack cloud]<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">1) admin create Firewall and create Filrewall rule accepting ICMP request from outside openstack cloud, and
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">2) ICMP request packets incoming from outside to inside, and<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">3) someday, admin detects that ICMP rule is security vulnerability and create Firewall rule blocking ICMP request from outside.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">but ICMP request packets still incoming due to ACCEPT rule(*), because ICMP connection still hit rule at second(*).<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p><span lang="EN-US">Thanks.<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></span></p><span class="HOEnZb"><font color="#888888">
<p><span lang="EN-US"><u></u> <u></u></span></p>
<p><span lang="EN-US">kazuhiro MIYASHITA<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt"><u></u> <u></u></span></p>
</font></span></div>
</div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>