Mailing-List: contact issues-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Date: Tue, 15 Aug 2017 08:36:00 +0000 (UTC)
From: "Francois Scheurer (JIRA)" <jira@apache.org>
To: cloudstack-issues@incubator.apache.org
Message-ID: <JIRA.13093510.1502291796000.32114.1502786160119@Atlassian.JIRA>
In-Reply-To: <JIRA.13093510.1502291796000@Atlassian.JIRA>
References: <JIRA.13093510.1502291796000@Atlassian.JIRA> <JIRA.13093510.1502291796607@jira-lw-us.apache.org>
Subject: [jira] [Updated] (CLOUDSTACK-10043)  Egress Rule in VPC ACL broken
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Tue, 15 Aug 2017 08:36:05 -0000


     [ https://issues.apache.org/jira/browse/CLOUDSTACK-10043?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Francois Scheurer updated CLOUDSTACK-10043:
-------------------------------------------
    Description: 
The Network Offering of the VPC Tier has a Default Egress Policy = Deny.

Some Allow Rules exist in the ACL, but _ALL_ egress connections are possible.

Creating a Deny All rule explicit at the end of the rules is actually blocking ALL traffic (should not, because of the Allow rules).

The Iptables in the VR are wrong:
1) the allow & deny rules are in wrong order.
2) some rules are in mangle table instead of filter

Do you know how to fix this?

Thank you for your help.

Francois Scheurer

  was:
The Network Offering of the VPC Tier has a Default Egress Policy = Deny.

Some Allow Rules exist in the ACL, but _ALL_ egress connections are possible.

Creating a Deny All rule explicit at the end of the rules is actually blocking ALL traffic (should not, because of the Allow rules).

The Iptables in the VR are wrong:
1)the allow rules are in wrong order.
2)some rules are in mangle table instead of filter

Do you know how to fix this?

Thank you for your help.

Francois Scheurer


>  Egress Rule in VPC ACL broken
> ------------------------------
>
>                 Key: CLOUDSTACK-10043
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10043
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Virtual Router, VPC
>    Affects Versions: 4.9.2.0
>         Environment: CS 4.9.2 with XenServer 6.5SP1
>            Reporter: Francois Scheurer
>            Priority: Blocker
>
> The Network Offering of the VPC Tier has a Default Egress Policy = Deny.
> Some Allow Rules exist in the ACL, but _ALL_ egress connections are possible.
> Creating a Deny All rule explicit at the end of the rules is actually blocking ALL traffic (should not, because of the Allow rules).
> The Iptables in the VR are wrong:
> 1) the allow & deny rules are in wrong order.
> 2) some rules are in mangle table instead of filter
> Do you know how to fix this?
> Thank you for your help.
> Francois Scheurer


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)