Open Stack

Hi, Stackers,

Use case description:

Firewal is not working when setting the destination-ip-address as VM's
floating ip
Steps to Reproduce:
1. create one network and attached it to the newly created router
2. Create VMs on the above network
3. create security group rule for icmp
4. create an external network and attach it to the router as gateway
5. create floating ip and associate it to the VMs
6. create a first firewall rule as protocol=icmp , action =deny and
desitination-ip-address as floatingip
7. create second firewall rule as protocol=any action=allow
8. attach the rule to the policy and the policy to the firewall
9. ping the VMs floating ip from network node which is having the external
network configured.

Actual Results:
Ping succeeds

Expected Results:
Ping should fail as per the firewall rule

router's functionality both NAT and Firewall, so , although we have created
firewall rule, DNAT will take action(change floating ip to fix ip) in
PREROUTING chain preferentially when network node ping vm's floating ip, so
firewall rules in FORWARD chain couldn't match because packet's ip has been
changed to fix ip.

additional case:
if we change firewall rule protocol=icmp , action =deny and
desitination-ip-address as fix ip, ping fail.

in short , router firewall can't take effect about floating ip.

what do you think?

Cheers,

Xurong Yang
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20140605/c8f03f3e/attachment.html>