private gateway ACLs are not applied correctly #9838

Activity

1. weizhouapache

   added this to the 4.19.2.0 milestone on Oct 22, 2024
2. DaanHoogland

   added

   component:vpc

   component:networking

   on Oct 28, 2024
3. DaanHoogland

   added this to Apache CloudStack BugFest - Issueson Dec 5, 2024
4. DaanHoogland

   moved this to Todo in Apache CloudStack BugFest - Issueson Dec 5, 2024
5. weizhouapache

   self-assigned this

   on Jan 20, 2025
6. weizhouapache

   moved this from Todo to Dev In Progress in Apache CloudStack BugFest - Issueson Jan 22, 2025
7. vishesh92

   linked a pull request that will close this issueFix private gateway acl on static routes #10262on Jan 24, 2025
8. vishesh92

   moved this from Dev In Progress to ready for Review in Apache CloudStack BugFest - Issueson Jan 24, 2025
9. vishesh92

   moved this from ready for Review to Dev In Progress in Apache CloudStack BugFest - Issueson Jan 24, 2025
10. vishesh92

    removed a link to a pull requestFix private gateway acl on static routes #10262on Jan 24, 2025
11. weizhouapache commented on Jan 24, 2025

    

    weizhouapache

    on Jan 24, 2025

    MemberAuthor

    More actions

    it looks the issue is because of the order of rules

    root@r-10-VM:~#iptables-save |grep FORWARD
    :FORWARD ACCEPT [97:8028]
    -A FORWARD -j VPN_STATS_eth1
    -A FORWARD -j VPN_STATS_eth2
    :FORWARD DROP [95:7876]
    -A FORWARD -j NETWORK_STATS_eth2
    -A FORWARD -j NETWORK_STATS_eth1
    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -s 172.18.0.0/20 ! -d 172.18.0.0/20 -j ACCEPT
    -A FORWARD -d 10.200.0.0/24 -o eth2 -j ACL_INBOUND_eth2
    -A FORWARD -d 172.18.1.0/24 -o eth3 -j ACL_INBOUND_eth3
    

    because of

    -A FORWARD -s 172.18.0.0/20 ! -d 172.18.0.0/20 -j ACCEPT
    

    the packet from vm to private gateway is accepted, so that the next rule becomes useless

    -A FORWARD -d 10.200.0.0/24 -o eth2 -j ACL_INBOUND_eth2
    
12. weizhouapache

    linked a pull request that will close this issueVPC VR: fix ACL between tier and private gateway #10268on Jan 24, 2025
13. weizhouapache

    moved this from Dev In Progress to ready for Review in Apache CloudStack BugFest - Issueson Jan 24, 2025
14. DaanHoogland commented on Feb 13, 2025

    

    DaanHoogland

    on Feb 13, 2025

    Contributor

    More actions

    fixed in #10268
15. DaanHoogland

    closed this as completedon Feb 13, 2025
16. github-project-automation

    moved this from ready for Review to Done in Apache CloudStack BugFest - Issueson Feb 13, 2025
17. DaanHoogland

    removed this from Apache CloudStack BugFest - Issueson Aug 22, 2025