mirror of
https://github.com/apache/cloudstack.git
synced 2025-11-03 04:12:31 +01:00
5ca5851b1b
Summary of changes: - Mutiple routing table for each public interface is added (previously there is only one routing table ). when the packet is send out of public interface corresponding per-interface routing table will be used. per-interface routing table will modified when ever ip/interface added/deleted. - New parameter is added to ipassoc command to include the default gateway for every interface/ip. prevously it is using only one public interface to send out, default gateway is obtained at the boot up time. - In the DNAT case. In the revese path(from guest vm to outside, or when DNAT packet receives from the eth0) the public ip/source ip will not be available till POSTROUTING. to overcome this, DNAT connection are marked with routing table number at the time of connection creation, in the reverse path the routing table# from DNAT connection is used to detect per-interface routing table.
35 lines
1.2 KiB
Plaintext
35 lines
1.2 KiB
Plaintext
*nat
|
|
:PREROUTING ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
COMMIT
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
-A INPUT -d 224.0.0.18/32 -j ACCEPT
|
|
-A INPUT -d 225.0.0.50/32 -j ACCEPT
|
|
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
-A INPUT -i eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
-A INPUT -p icmp -j ACCEPT
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -i eth0 -p udp -m udp --dport 67 -j ACCEPT
|
|
-A INPUT -i eth0 -p udp -m udp --dport 53 -j ACCEPT
|
|
-A INPUT -i eth1 -p tcp -m state --state NEW --dport 3922 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m state --state NEW --dport 8080 -j ACCEPT
|
|
-A INPUT -i eth0 -p tcp -m state --state NEW --dport 80 -j ACCEPT
|
|
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
-A FORWARD -i eth0 -o eth2 -j ACCEPT
|
|
-A FORWARD -i eth2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
COMMIT
|
|
*mangle
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
-A POSTROUTING -p udp --dport bootpc -j CHECKSUM --checksum-fill
|
|
-A PREROUTING -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
|
|
COMMIT
|