From 84c2a8ae603d2bc311e13b29e9ea34a98d3145fd Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Fri, 24 Jan 2025 13:53:01 +0100 Subject: [PATCH 1/2] VPC VR: fix ACL between tier and private gateway --- systemvm/debian/opt/cloud/bin/cs/CsAddress.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py index 3cb782daf7ab..14cbbfbe1147 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py @@ -542,7 +542,7 @@ def fw_vpcrouter(self): (self.dev, guestNetworkCidr, self.address['gateway'], self.dev)]) if self.is_private_gateway(): - self.fw.append(["filter", "", "-A FORWARD -d %s -o %s -j ACL_INBOUND_%s" % + self.fw.append(["filter", "front", "-A FORWARD -d %s -o %s -j ACL_INBOUND_%s" % (self.address['network'], self.dev, self.dev)]) self.fw.append(["filter", "", "-A ACL_INBOUND_%s -j DROP" % self.dev]) self.fw.append(["mangle", "", From 8d3468efabbfb7a8d92c67cdd2cacfae8708ad34 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Thu, 30 Jan 2025 17:20:31 +0100 Subject: [PATCH 2/2] VPC VR: update iptables rule This fixes the issue that SSH/ping does not work from vm in private network to vm in vpc, if - VPC tier uses ACL default_allow - private gateway uses ACL "allow egress but deny ingress" --- systemvm/debian/opt/cloud/bin/cs/CsAddress.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py index 14cbbfbe1147..3d6d1f6f7222 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py @@ -544,6 +544,8 @@ def fw_vpcrouter(self): if self.is_private_gateway(): self.fw.append(["filter", "front", "-A FORWARD -d %s -o %s -j ACL_INBOUND_%s" % (self.address['network'], self.dev, self.dev)]) + self.fw.append(["filter", "front", "-A FORWARD -d %s -o %s -m state --state RELATED,ESTABLISHED -j ACCEPT" % + (self.address['network'], self.dev)]) self.fw.append(["filter", "", "-A ACL_INBOUND_%s -j DROP" % self.dev]) self.fw.append(["mangle", "", "-A PREROUTING -m state --state NEW -i %s -s %s ! -d %s/32 -j ACL_OUTBOUND_%s" %