Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Date: Tue, 5 Apr 2016 08:29:30 +0100 (BST)
From: Nux! <nux@li.nux.ro>
To: dev@cloudstack.apache.org
Message-ID: <1007848747.1626.1459841370145.JavaMail.zimbra@li.nux.ro>
In-Reply-To: <1551AA76-43C0-45FE-8F62-4C2FE4E36A96@persistent.co.in>
References: <1154113302.104683.1459507330707.JavaMail.zimbra@li.nux.ro>
 <215197425.934.1459788427995.JavaMail.zimbra@li.nux.ro>
 <1551AA76-43C0-45FE-8F62-4C2FE4E36A96@persistent.co.in>
Subject: Re: Hooking into the SecurityGroups
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Thread-Topic: Hooking into the SecurityGroups
Thread-Index: gckrq9IDtix2Y6HMEjqZBSL4jfz2wqBhYa1M8GU2xwAhSNjHwA==

Thanks Jayapal!

I won't propose this change as a pull request since this is a pretty custom=
 job.

Myipset (with a different name) will include all our data centre (AS) subne=
ts, the end result being that with a simple "iptables-save -c" I can now kn=
ow what traffic was done against our data centre as well as global traffic;=
 then with simple arithmetic I can calculate exactly the amount of traffic =
done outside our networks. e.g.

iptables-save -c |grep -i vnet0
[542306:28257982] -A BF-breth0-109-IN -m physdev --physdev-in vnet0 --physd=
ev-is-bridged -m set --match-set myipset dst=20
[719558:37497155] -A BF-breth0-109-IN -m physdev --physdev-in vnet0 --physd=
ev-is-bridged -j i-2-38-def=20
[562386:3982131066] -A BF-breth0-109-OUT -m physdev --physdev-out vnet0 --p=
hysdev-is-bridged -m set --match-set myipset src=20
[765296:5230761832] -A BF-breth0-109-OUT -m physdev --physdev-out vnet0 --p=
hysdev-is-bridged -j i-2-38-def
...

Logging and graphing this is another adventure, but I'm glad I got the Clou=
dstack bit done, unless anyone else wants to point to some horrible mistake=
. :)

--
Sent from the Delta quadrant using Borg technology!

Nux!
www.nux.ro

----- Original Message -----
> From: "Jayapal Uradi" <jayapal.uradi@accelerite.com>
> To: dev@cloudstack.apache.org
> Sent: Tuesday, 5 April, 2016 06:00:19
> Subject: Re: Hooking into the SecurityGroups

> Hi Nux,
>=20
> I think ipset =E2=80=98myipset=E2=80=99 changes might be there in other c=
ommits. If you do not
> have special requirement then you can use the existing ipset which is wit=
h the
> vmname ex: i-2-3-VM. Except this it looks good to me.
>=20
>=20
> Thanks,
> Jayapal
>=20
>=20
>> On 04-Apr-2016, at 10:17 pm, Nux! <nux@li.nux.ro> wrote:
>>=20
>> Well, this is what we got working in the end. If someone has any suggest=
ions on
>> how to improve it, that'd be great.
>>=20
>> https://github.com/NuxRo/cloudstack/commit/de6f97367fc2dc02378f367c462ea=
aec8f92e234
>>=20
>> --
>> Sent from the Delta quadrant using Borg technology!
>>=20
>> Nux!
>> www.nux.ro
>>=20
>> ----- Original Message -----
>>> From: "Nux!" <nux@li.nux.ro>
>>> To: "dev" <dev@cloudstack.apache.org>
>>> Sent: Friday, 1 April, 2016 11:42:10
>>> Subject: Hooking into the SecurityGroups
>>=20
>>> Hi,
>>>=20
>>> I want to hook into the SGs and add a few iptables rules every time a V=
M is
>>> spawned and delete them when the VM is moved/deleted.
>>> Has anyone done this before? Any pointers before I go and butcher it? :=
-)
>>>=20
>>> Lucian
>>>=20
>>> --
>>> Sent from the Delta quadrant using Borg technology!
>>>=20
>>> Nux!
>>> www.nux.ro
>=20
>=20
>=20
>=20
> DISCLAIMER
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> This e-mail may contain privileged and confidential information which is =
the
> property of Accelerite, a Persistent Systems business. It is intended onl=
y for
> the use of the individual or entity to which it is addressed. If you are =
not
> the intended recipient, you are not authorized to read, retain, copy, pri=
nt,
> distribute or use this message. If you have received this communication i=
n
> error, please notify the sender and delete all copies of this message.
> Accelerite, a Persistent Systems business does not accept any liability f=
or
> virus infected mails.