<div dir="ltr">Hi Rami, <br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jun 18, 2013 at 11:36 PM, Rami Vaknin <span dir="ltr"><<a href="mailto:rvaknin@redhat.com" target="_blank">rvaknin@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
I read the security groups documentation from the admin guide, I have few things that I'm not sure I fully understand, any clarification would be appreciated:<br>
<br>
<br>
i. <a href="http://docs.openstack.org/trunk/openstack-network/admin/content/securitygroups.html" target="_blank">http://docs.openstack.org/<u></u>trunk/openstack-network/admin/<u></u>content/securitygroups.html</a><br>
<br>
"If a security group is not specified the port will be associated with a 'default' security group. By default this group will drop all ingress traffic and allow all egress. Rules can be added to this group in order to change the behaviour"<br>
<br></blockquote><div style>There is a small typo here: This should also add and allow traffic from members of the default group. </div><div style><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The default behaviour is to allow all egress traffic, how do I make constraints on this traffic? it seems to me that the rules are kind of white list, how for instance can I disallow egress tcp traffic?</blockquote><div>
<br></div><div style>Correct, security groups are a white lists of what's allowed. The only way you could disallow egress tcp traffic would be if you explicitly removed all the egress rules and only added rules for traffic that you wanted through. Stay tuned for the FWaaS stuff that will allow you to specifically disallow all egress traffic rather than white list. </div>
<div style> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----------<br>
<br>
ii. <a href="http://docs.openstack.org/trunk/openstack-network/admin/content/securitygroups.html" target="_blank">http://docs.openstack.org/<u></u>trunk/openstack-network/admin/<u></u>content/securitygroups.html</a><br>
<br>
"When a port is created in OpenStack Networking it is associated with a security group. If a security group is not specified the port will be associated with a 'default' security group"<br>
<br>
I'm adding a rule without denoting the security group and I get "quantum security-group-rule-create: error: too few arguments", when I add "default" to the exact same command - it works, is this a bug or am I missing something?<br>
<br></blockquote><div><br></div><div style>You need to specify the security group that you want the rule to be a part of otherwise it doesn't know which group to put our rule in. </div><div style><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
----------<br>
<br>
iii. <a href="http://docs.openstack.org/trunk/openstack-network/admin/content/securitygroup_api_abstractions.html" target="_blank">http://docs.openstack.org/<u></u>trunk/openstack-network/admin/<u></u>content/securitygroup_api_<u></u>abstractions.html</a><br>
<br>
I see that there are default values for the security group attributes, however, it's hard to derive what these default values means, for instance, "remote_ip_prefix" is the white list of the traffic source ip(s), what if I add a rule without denoting this "remote_ip_prefix" - does it mean that the traffic is allowed from any source ip(s)?<span class="HOEnZb"><font color="#888888"><br>
<br></font></span></blockquote><div style>Correct, if a value is not specified it is wild carded. For example, if one does: quantum security-group-rule-create --protocol tcp --ethertype IPv4 default; that would allow all tcp traffic (on all ports).</div>
<div style><br></div><div style><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="HOEnZb"><font color="#888888">
-- <br>
<br>
Thanks,<br>
<br>
Rami Vaknin.<br></font></span></blockquote><div><br></div><div style>Thanks, </div><div style><br>Aaron </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="HOEnZb"><font color="#888888">
<br>
<br>
______________________________<u></u>_________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~<u></u>openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~<u></u>openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/<u></u>ListHelp</a><br>
</font></span></blockquote></div><br></div></div>