apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

VPC : by default , outgoing traffic is allowed out, once egress rules are added, only traffic specified in those are allowed out, others are blocked

Browse Source
This commit is contained in:
Anthony Xu 2012-09-07 17:03:12 -07:00
parent b52bd1fc5a
commit 3cfe01d07c
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
patches/systemvm/debian/config/opt/cloud/bin/vpc_acl.sh
View File

@ -126,6 +126,7 @@ acl_entry_for_guest_network() {
sudo iptables -I ACL_INBOUND_$dev -p $prot -s $lcidr \ sudo iptables -I ACL_INBOUND_$dev -p $prot -s $lcidr \
--icmp-type $typecode -j ACCEPT --icmp-type $typecode -j ACCEPT
else else
let egress++
sudo iptables -t mangle -I ACL_OUTBOUND_$dev -p $prot -d $lcidr \ sudo iptables -t mangle -I ACL_OUTBOUND_$dev -p $prot -d $lcidr \
--icmp-type $typecode -j ACCEPT --icmp-type $typecode -j ACCEPT
fi fi
@ -135,6 +136,7 @@ acl_entry_for_guest_network() {
sudo iptables -I ACL_INBOUND_$dev -p $prot -s $lcidr \ sudo iptables -I ACL_INBOUND_$dev -p $prot -s $lcidr \
$DPORT -j ACCEPT $DPORT -j ACCEPT
else else
let egress++
sudo iptables -t mangle -I ACL_OUTBOUND_$dev -p $prot -d $lcidr \ sudo iptables -t mangle -I ACL_OUTBOUND_$dev -p $prot -d $lcidr \
$DPORT -j ACCEPT $DPORT -j ACCEPT
fi fi
@ -199,7 +201,7 @@ fi
success=0 success=0
acl_chain_for_guest_network acl_chain_for_guest_network
egress=0
for r in $rules_list for r in $rules_list
do do
acl_entry_for_guest_network $r acl_entry_for_guest_network $r
@ -219,6 +221,12 @@ then
acl_restore acl_restore
else else
logger -t cloud "$(basename $0): deleting backup for guest network: $gcidr" logger -t cloud "$(basename $0): deleting backup for guest network: $gcidr"
if [ $egress -eq 0 ]
then
sudo iptables -t mangle -A ACL_OUTBOUND_$dev -j ACCEPT 2>/dev/null
else
sudo iptables -t mangle -A ACL_OUTBOUND_$dev -j DROP 2>/dev/null
fi
acl_switch_to_new acl_switch_to_new
fi fi
unlock_exit $success $lock $locked unlock_exit $success $lock $locked