Mailing-List: contact users-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@cloudstack.apache.org
From: =?utf-8?q?David=20Amor=c3=adn?= <david.amorin@adderglobal.com>
To: "users@cloudstack.apache.org" <users@cloudstack.apache.org>
Subject: Re[6]: Network ACL rules in VPCs are applied in an inverted order
 (CLOUDSTACK-9404)
Date: Mon, 17 Oct 2016 09:16:03 +0000
Message-Id: <emd9368a95-e725-4fac-aad4-33457e3e296d@pcpaddgno010>
In-Reply-To: <BY2PR02MB20077D7723D8BB58118F7D74A9C40@by2pr02mb2007.namprd02.prod.outlook.com>
References: <75e37b7e-53a7-73ad-8f07-ff8d29e76558@failiem.lv>
 <f22fa182-37df-492b-376e-ef1c9067eee9@failiem.lv>
 <3e7f9f4f-934e-de28-1617-465ba6d443d8@failiem.lv>
 <BY2PR02MB20072E06D7A51A1A2798089CA9CE0@by2pr02mb2007.namprd02.prod.outlook.com>
 <BY2PR02MB2007757DF15CF34C83D97782A9C50@by2pr02mb2007.namprd02.prod.outlook.com>
 <BY2PR02MB20072D7E134ACE395E4A8C5DA9C50@by2pr02mb2007.namprd02.prod.outlook.com>
 <BY2PR02MB2007AFEB512C72C9F4EDEB74A9C40@by2pr02mb2007.namprd02.prod.outlook.com>
 <BY2PR02MB20077D7723D8BB58118F7D74A9C40@by2pr02mb2007.namprd02.prod.outlook.com>
Reply-To: =?utf-8?q?David=20Amor=c3=adn?= <david.amorin@adderglobal.com>
User-Agent: eM_Client/7.0.26687.0
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="------=_MBF09DAE68-302E-4FE1-BEC3-76EBE0E540BF"
archived-at: Mon, 17 Oct 2016 09:16:17 -0000

--------=_MBF09DAE68-302E-4FE1-BEC3-76EBE0E540BF
Content-Type: text/plain; format=flowed; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi ,
I did a couple of tests more and i can confirm the issue=20
(CLOUDSTACK-9404) still happens with the version CS 4.9 using the VPC=20
router version 4.6

See an example:

I have an egress rules like following:
Rule number: 101CIDR: 8.8.8.8/32Action: Allow, Traffic Type:=20
EgressProtocol: ICMP, ICMPtype: -1, ICMPCode: -1

Then I add this rule:
Rule number: 1002CIDR: 0.0.0.0/0Action: Deny, Traffic Type:=20
EgressProtocol: ALL

Checking the VR, in file /etc/iptables/router_rules.v4, the rules are=20
applied in wrong order:
-A ACL_OUTBOUND_eth2 -d 224.0.0.18/32 -j ACCEPT
-A ACL_OUTBOUND_eth2 -d 225.0.0.50/32 -j ACCEPT
-A ACL_OUTBOUND_eth2 -j DROP
-A ACL_OUTBOUND_eth2 -d 8.8.8.8/32 -p icmp -m icmp --icmp-type any -j=20
ACCEPT


But then if i restart the VPC and clean up, I check again iptables and=20
now is correct order:
-A ACL_OUTBOUND_eth2 -d 224.0.0.18/32 -j ACCEPT
-A ACL_OUTBOUND_eth2 -d 225.0.0.50/32 -j ACCEPT
-A ACL_OUTBOUND_eth2 -d 8.8.8.8/32 -p icmp -m icmp --icmp-type any -j=20
ACCEPT
-A ACL_OUTBOUND_eth2 -j DROP

Is the VPC rotuer version 4.6 the latest one?

I really apprecciate if somebody else can confirm this issue

Best,

David

------ Mensaje original ------
De: "Simon Weller" <sweller@ena.com>
Para: "users@cloudstack.apache.org" <users@cloudstack.apache.org>;=20
"David Amor=C3=ADn" <david.amorin@adderglobal.com>
Enviado: 05/10/2016 18:35:48
Asunto: Re: Re[4]: Network ACL rules in VPCs are applied in an inverted=20
order (CLOUDSTACK-9404)

>Try doing a restart with network cleanup and see if that fixes your=20
>problem. The fixes are in the system iso and that will required a=20
>redeploy.
>
>
>
>- Si
>
>
>--------------------------------------------------------------------------=
------
>From: David Amor=C3=ADn <david.amorin@adderglobal.com>
>Sent: Wednesday, October 5, 2016 11:18 AM
>To: Simon Weller; users@cloudstack.apache.org
>Subject: Re[4]: Network ACL rules in VPCs are applied in an inverted=20
>order (CLOUDSTACK-9404)
>
>Yes, we did the upgrade from 4.5.2 to 4.9.0
>
>
>
>
>------ Mensaje original ------
>De: "Simon Weller" <sweller@ena.com>
>Para: "users@cloudstack.apache.org" <users@cloudstack.apache.org>;=20
>"David Amor=C3=ADn" <david.amorin@adderglobal.com>
>Enviado: 05/10/2016 18:11:26
>Asunto: Re: Re[2]: Network ACL rules in VPCs are applied in an inverted=
=20
>order (CLOUDSTACK-9404)
>
>>Was this an upgrade from an older release?
>>
>>
>>
>>-------------------------------------------------------------------------=
-------
>>From: David Amor=C3=ADn <david.amorin@adderglobal.com>
>>Sent: Wednesday, October 5, 2016 10:11 AM
>>To:users@cloudstack.apache.org
>>Subject: Re[2]: Network ACL rules in VPCs are applied in an inverted=20
>>order (CLOUDSTACK-9404)
>>
>>We are running 4.9.0 and we are still facing the issues of the ACL=20
>>Rules
>>(CLOUDSTACK-9404)
>>
>>
>>
>>------ Mensaje original ------
>>De: "Simon Weller" <sweller@ena.com>
>>Para: "users@cloudstack.apache.org" <users@cloudstack.apache.org>;
>>"David Amor=C3=ADn" <david.amorin@adderglobal.com>
>>Enviado: 04/10/2016 18:02:22
>>Asunto: Re: Network ACL rules in VPCs are applied in an inverted order
>>(CLOUDSTACK-9404)
>>
>> >David,
>> >
>> >
>> >What version are you currently running?
>> >
>> >
>> >I believe 2 patches got into 4.9.0 related to this. #1581 and #1616.
>> >
>> >
>> >At least #1581 was also merged into 4.8.x for the next point release.
>> >
>> >
>> >- Si
>> >
>> >________________________________
>> >From: David Amor=C3=ADn <david.amorin@adderglobal.com>
>> >Sent: Tuesday, October 4, 2016 10:47 AM
>> >To: users@cloudstack.apache.org
>> >Subject: Network ACL rules in VPCs are applied in an inverted order
>> >(CLOUDSTACK-9404)
>> >
>> >Hi all,
>> >I see this bug is already resolved
>> >
>> >https://issues.apache.org/jira/browse/CLOUDSTACK-9404
>> >[CLOUDSTACK-9404] Network ACL rules in VPCs are applied in
>> >...<https://issues.apache.org/jira/browse/CLOUDSTACK-9404>
>> >issues.apache.org
>> >Linked Applications. Loading... Dashboards
>> >
>> >
>> >
>> >
>> >Do you know if will be available on 4.9.1?
>> >
>> >Thanks
>> >
>> >David
>> >
>> >
>> >
>> >
>> >
>>
--------=_MBF09DAE68-302E-4FE1-BEC3-76EBE0E540BF--