Mailing-List: contact users-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@cloudstack.apache.org
Received-SPF: pass (athena.apache.org: domain of jayapalreddy.uradi@citrix.com
 designates 203.166.19.134 as permitted sender)
From: Jayapal Reddy Uradi <jayapalreddy.uradi@citrix.com>
To: "<users@cloudstack.apache.org>" <users@cloudstack.apache.org>
Subject: Re: How to create a network offering without firewall?
Thread-Topic: How to create a network offering without firewall?
Thread-Index: AQHOc6mOTYP2krLVNUiXbeDpM/l9ag==
Date: Fri, 28 Jun 2013 02:45:31 +0000
Message-ID: <618CCD9A-F716-42DA-86CC-296973C4F96A@citrix.com>
References: <tencent_6849AF970C585EB27F4F3E69@qq.com>
In-Reply-To: <tencent_6849AF970C585EB27F4F3E69@qq.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <CEA8E630BF61FD40A7D7EA100225AAAE@citrix.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

THe problem is there is no source NAT rule added in iptables nat table on r=
outer.
Why the source NAT rule is not added on the router ?
In your network ip address do you have source NAT ip ?

Thanks,
Jayapal


On 28-Jun-2013, at 8:06 AM, WXR <474745079@qq.com>
 wrote:

> I try to add the rule "iptables -A FW_OUTBOUND -j ACCEPT" to the vrouter =
firewall but unfortunately it takes no effect.
>=20
> This is the iptables rules in file "/etc/iptables/rules"
>=20
> *nat
> :PREROUTING ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> COMMIT
> *filter
> :INPUT DROP [0:0]
> :FORWARD DROP [0:0]
> :OUTPUT ACCEPT [0:0]
> :FW_OUTBOUND - [0:0]
> -A INPUT -d 224.0.0.18/32 -j ACCEPT
> -A INPUT -d 225.0.0.50/32 -j ACCEPT
> -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -i eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --dport 67 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --dport 53 -j ACCEPT
> -A INPUT -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
> -A INPUT -i eth1 -p tcp -m state --state NEW --dport 3922 -j ACCEPT
> -A INPUT -i eth0 -p tcp -m state --state NEW --dport 80 -j ACCEPT
> -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -i eth2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -i eth0 -o eth0 -m state --state NEW -j ACCEPT
> -A FORWARD -i eth0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -i eth0 -o eth2 -j FW_OUTBOUND
> -I FW_OUTBOUND -m state --state RELATED,ESTABLISHED -j ACCEPT
> COMMIT
> *mangle
> :PREROUTING ACCEPT [0:0]
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> -A PREROUTING -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-=
mark
> -A POSTROUTING -p udp --dport bootpc -j CHECKSUM --checksum-fill
> COMMIT
>=20
> Is there anything wrong?
>=20
>=20
>=20
> ------------------ Original ------------------
> From:  ""<emunoz@intecom.ad>;
> Date:  Thu, Jun 27, 2013 06:40 PM
> To:  "users@cloudstack.apache.org"<users@cloudstack.apache.org>;=20
>=20
> Subject:  RE: How to create a network offering without firewall?
>=20
>=20
>=20
> I had this issue too some days ago. I solved it by logging into the Virtu=
al Router over ssh and adding this rule to the Firewall:=20
>=20
> iptables -A FW_OUTBOUND -j ACCEPT
>=20
> I hope this helps.
>=20
> Regards
>=20
> -----Mensaje original-----
> De: Jayapal Reddy Uradi [mailto:jayapalreddy.uradi@citrix.com]=20
> Enviado el: jueves, 27 de junio de 2013 12:37
> Para: <users@cloudstack.apache.org>
> Asunto: Re: How to create a network offering without firewall?
>=20
> Is internet accessible from from router ?
> If it is accessible please send router iptables rules on pastebin.com
>=20
> Thanks,
> jayapal
>=20
> On 27-Jun-2013, at 3:34 PM, WXR <474745079@qq.com>
> wrote:
>=20
>> Sorry,the instance can access the vrouter gateway ip ,but can not access=
 the Internet.
>>=20
>>=20
>> ------------------ Original ------------------
>> From:  "WXR"<474745079@qq.com>;
>> Date:  Thu, Jun 27, 2013 06:01 PM
>> To:  "users"<users@cloudstack.apache.org>;
>>=20
>> Subject:  Re: How to create a network offering without firewall?
>>=20
>>=20
>>=20
>> I have added a egress rule like this:
>> Source CIDR    Protocol    Start Port    End Port=20
>> 0.0.0.0/0         All            All                All
>>=20
>> The vrouter vm can also access the Internet.
>> But the instance vm is still able to access the vrouter gateway ip and t=
he Internet.
>>=20
>>=20
>>=20
>>=20
>> ------------------ Original ------------------
>> From:  "Murali Reddy"<Murali.Reddy@citrix.com>;
>> Date:  Thu, Jun 27, 2013 05:21 PM
>> To:  "users@cloudstack.apache.org"<users@cloudstack.apache.org>;
>>=20
>> Subject:  Re: How to create a network offering without firewall?
>>=20
>>=20
>>=20
>>=20
>> Yes, egress firewall default action is 'BLOCK'. Here is a nice blog=20
>> from Radhika=20
>> http://writersopendiary.wordpress.com/2013/05/27/egress-firewall-rules
>> -in-a
>> pache-cloudstack/
>>=20
>> On 27/06/13 2:21 PM, "WXR" <474745079@qq.com> wrote:
>>=20
>>> By the way , when I select the default guestnetworkwithsourceNAT and=20
>>> create an instance,the vm can not access to the Internet,is this a=20
>>> default setting?how can I let the vm access the Internet?
>>>=20
>>>=20
>>>=20
>>>=20
>>> ------------------ Original ------------------
>>> From:  "Murali Reddy"<Murali.Reddy@citrix.com>;
>>> Date:  Thu, Jun 27, 2013 04:46 PM
>>> To:  "users@cloudstack.apache.org"<users@cloudstack.apache.org>;
>>>=20
>>> Subject:  Re: How to create a network offering without firewall?
>>>=20
>>>=20
>>>=20
>>>=20
>>> Also, by default all the ports that will be used by edge services are=20
>>> blocked by iptable config in the router VM templates. They needed to=20
>>> be opened explicitly with firewall rules.
>>>=20
>>> On 27/06/13 2:08 PM, "Jayapal Reddy Uradi"=20
>>> <jayapalreddy.uradi@citrix.com>
>>> wrote:
>>>=20
>>>> With out firewall provider you can't have sourceNAT and static NAT=20
>>>> services because these services are provided by firewall provider only=
.
>>>>=20
>>>> Thanks,
>>>> Jayapal
>>>>=20
>>>> On 27-Jun-2013, at 1:35 PM, WXR <474745079@qq.com>
>>>> wrote:
>>>>=20
>>>>> If I create a new network offering and check=20
>>>>> dns,dhcp,userdata,sourceNAT,staticNAT,not check the firewall=20
>>>>> service.But the firewall will be added into it automatically.
>>>>> I don't need the firewall service ,how can I create a network=20
>>>>> offering without firewall?
>>>>=20
>>>>=20
>>>=20
>>>=20
>>> .
>>=20
>>=20
>> .
>=20
> .