mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
140 lines
6.7 KiB
XML
140 lines
6.7 KiB
XML
<?xml version='1.0' encoding='utf-8' ?>
|
|
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
|
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
|
|
%BOOK_ENTITIES;
|
|
]>
|
|
<!-- Licensed to the Apache Software Foundation (ASF) under one
|
|
or more contributor license agreements. See the NOTICE file
|
|
distributed with this work for additional information
|
|
regarding copyright ownership. The ASF licenses this file
|
|
to you under the Apache License, Version 2.0 (the
|
|
"License"); you may not use this file except in compliance
|
|
with the License. You may obtain a copy of the License at
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
Unless required by applicable law or agreed to in writing,
|
|
software distributed under the License is distributed on an
|
|
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
KIND, either express or implied. See the License for the
|
|
specific language governing permissions and limitations
|
|
under the License.
|
|
-->
|
|
<section id="configure-acl">
|
|
<title>Configuring Access Control List</title>
|
|
<para>Define Network Access Control List (ACL) on the VPC virtual router to control incoming
|
|
(ingress) and outgoing (egress) traffic between the VPC tiers, and the tiers and Internet. By
|
|
default, all incoming and outgoing traffic to the guest networks is blocked. To open the ports,
|
|
you must create a new network ACL. The network ACLs can be created for the tiers only if the
|
|
NetworkACL service is supported.</para>
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>Log in to the &PRODUCT; UI as an administrator or end user.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>In the left navigation, choose Network.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>In the Select view, select VPC.</para>
|
|
<para>All the VPCs that you have created for the account is listed in the page.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Click the Settings icon.</para>
|
|
<para>The following options are displayed.</para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>IP Addresses</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Gateways</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Site-to-Site VPN</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Network ACLs</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Select Network ACLs.</para>
|
|
<para>The Network ACLs page is displayed.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Click Add Network ACLs.</para>
|
|
<para>To add an ACL rule, fill in the following fields to specify what kind of network traffic
|
|
is allowed in this tier. </para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para><emphasis role="bold">CIDR</emphasis>: The CIDR acts as the Source CIDR for the
|
|
Ingress rules, and Destination CIDR for the Egress rules. To accept traffic only from or
|
|
to the IP addresses within a particular address block, enter a CIDR or a comma-separated
|
|
list of CIDRs. The CIDR is the base IP address of the incoming traffic. For example,
|
|
192.168.0.0/22. To allow all CIDRs, set to 0.0.0.0/0.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><emphasis role="bold">Protocol</emphasis>: The networking protocol that sources use
|
|
to send traffic to the tier. The TCP and UDP protocols are typically used for data
|
|
exchange and end-user communications. The ICMP protocol is typically used to send error
|
|
messages or network monitoring data.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><emphasis role="bold">Start Port</emphasis>, <emphasis role="bold">End
|
|
Port</emphasis> (TCP, UDP only): A range of listening ports that are the destination
|
|
for the incoming traffic. If you are opening a single port, use the same number in both
|
|
fields.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><emphasis role="bold">Select Tier</emphasis>: Select the tier for which you want to
|
|
add this ACL rule.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><emphasis role="bold">ICMP Type</emphasis>, <emphasis role="bold">ICMP
|
|
Code</emphasis> (ICMP only): The type of message and error code that will be
|
|
sent.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><emphasis role="bold">Traffic Type</emphasis>: Select the traffic type you want to
|
|
apply. </para>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para><emphasis role="bold">Egress</emphasis>: To add an egress rule, select Egress
|
|
from the Traffic type drop-down box and click Add. This specifies what type of
|
|
traffic is allowed to be sent out of VM instances in this tier. If no egress rules
|
|
are specified, all traffic from the tier is allowed out at the VPC virtual router.
|
|
Once egress rules are specified, only the traffic specified in egress rules and the
|
|
responses to any traffic that has been allowed in through an ingress rule are
|
|
allowed out. No egress rule is required for the VMs in a tier to communicate with
|
|
each other.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para><emphasis role="bold">Ingress</emphasis>: To add an ingress rule, select Ingress
|
|
from the Traffic type drop-down box and click Add. This specifies what network
|
|
traffic is allowed into the VM instances in this tier. If no ingress rules are
|
|
specified, then no traffic will be allowed in, except for responses to any traffic
|
|
that has been allowed out through an egress rule.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
<note>
|
|
<para>By default, all incoming and outgoing traffic to the guest networks is blocked. To
|
|
open the ports, create a new network ACL.</para>
|
|
</note>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Click Add. The ACL rule is added.</para>
|
|
<para>To view the list of ACL rules you have added, click the desired tier from the Network
|
|
ACLs page, then select the Network ACL tab.</para>
|
|
<mediaobject>
|
|
<imageobject>
|
|
<imagedata fileref="./images/network-acl.png"/>
|
|
</imageobject>
|
|
<textobject>
|
|
<phrase>network-acl.png: adding, editing, deleting an ACL rule.</phrase>
|
|
</textobject>
|
|
</mediaobject>
|
|
<para>You can edit the tags assigned to the ACL rules and delete the ACL rules you have
|
|
created. Click the appropriate button in the Actions column.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
</section>
|