[Openstack] [Neutron][Security Groups] Pings to router ip from VM with default security groups
vivekanandan.narasimhan at hp.com
Mon May 19 11:15:06 UTC 2014
We have been trying to understand behavior of security group rules in icehouse stable.
The default security group contains 4 rules, two ingress and two egress.
The two ingress rules are one for IPv4 and other for IPv6.
We see both the ingress rules use cyclic security groups, wherein the rule contains remote_security_group_id
the same as the security_group_id itself.
Vm1 <-à R1 ß> Vm2
R1 interface 1 - 18.104.22.168
R1 interface 2 - 22.214.171.124
We saw that with default security groups, Vm1 can ping its DHCP Server IP because of provider_rule in security group rules.
Vm1 is also able to ping Vm2 via router R1, as Vm1 port and Vm2 port share the same security group.
However, we noticed that a Vm1 is also able to ping the router interfaces (R1 interface 1 ip - 126.96.36.199) and also ping router
interface (R1 interface 2 IP - 188.8.131.52) successfully.
Router interfaces donot have security groups associated with them, so the router interface IPs won' t get added to
the IPTables of the CN where the Vm1 resides.
We are not able to figure how the ping from the Vm1 to the router interfaces work when
no explicit rules are added to allow them.
Could you please throw some light on this?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openstack