[Starlingx-discuss] Security Groups (firewall driver) is now enabled by default

[Curtis]

On Fri, Apr 5, 2019 at 7:08 PM Qin, Kailun <kailun.qin at intel.com> wrote:

> Hi StarlingX Community,
>
>
>
> The neutron OVS firewall_driver driver was previously set to noop since
> there was no suitable firewall driver packaged. The security group support
> for OVS agent is now enabled by default with the native "openvswitch"
> firewall driver [0][1], which is stateful and based on openflow + conntrack
> implementation [2].
>
>
>

Thanks kindly for the update! This is actually a very interesting change.

Thanks,
Curtis



> Due to this change, it requires that appropriate security group rules be
> added to allow ingress traffic to the VM.
>
> *1.      **List the available security groups and note the ID of the
> security group that you want to use for your instance:*
>
> *$ openstack security group list*
>
> *2.      **By default (If you have not created any security groups), the
> “default” security group applies to all instances and includes firewall
> rules that deny remote access to instances. For Linux images such as
> CirrOS, we recommend allowing at least ICMP (ping) and secure shell (SSH).*
>
> *Add rules to the “default” security group:*
>
> *a.      **Permit ICMP (ping):*
>
> *$ openstack security group rule create --proto icmp default*
>
> *b.      **Permit secure shell (SSH) access:*
>
> *$ openstack security group rule create --proto tcp --dst-port 22 default*
>
> *3.      **In addition to the above rules (ICMP, SSH), other security
> group rules can be created, deleted and listed/showed within a certain
> security group *[3]*. And other security groups (besides “default”) can
> also be created/added, removed for a certain VM instance/server *[4]*.*
>
>
>
> Please kindly update your related StarlingX user docs/test cases w/ steps
> to apply the appropriate security rules.
>
>
>
> Let me know if any question. Thanks a lot.
>
>
>
> BR,
>
> Kailun
>
>
>
> [0] https://review.openstack.org/#/c/645054/
>
> [1] https://storyboard.openstack.org/#!/story/2002944
>
> [2]
> https://docs.openstack.org/neutron/latest/contributor/internals/openvswitch_firewall.html
>
> [3]
> https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/security-group-rule.html
>
> [4]
> https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/server.html
>
>
>
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
>


-- 
Blog: serverascode.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190408/bbe04608/attachment-0001.html>