Allow traffic from private gateway to internet #5397
Conversation
|
@ravening you can set acl on private gateway. |
@weizhouapache we tried and it didn't work. |
@ravening |
@weizhouapache I couldn't find the rule which adds the -s option which is needed for source ip subnet |
ravening
force-pushed
the
private-gateway-ping
branch
from
25c5769 to
cfbe1ba
Compare
|
@weizhouapache please review it again. |
@weizhouapache no they aren't same |
vpc vr acts as the gateway of private network, right ? |
@weizhouapache yes but gateway ends with .126 whereas up ends with .125 |
@ravening I think you should set the gateway to IP address when you add the private gateway. |
@weizhouapache we tried changing "private gateway" to ip address but then it breaks ssh from vm's to dedicated server |
@weizhouapache this is what we found if "private gateway" is same as public ip then ping from dedicated server to internet works but ssh from vm's to dedicated server doesnt work with all proper network acl's if they are different then ping from dedicated server to internet doesnt work but ssh from vm's to dedicated server works so after making this code change, both scenarios works |
@ravening I guess your dedicated servers are still using .126 as gateway. |
@weizhouapache 125 is configured as gateway in his routes on dedicated server |
@ravening have you restarted the vpc or vr ? |
@weizhouapache yes tried all those things... Nothing helped |
|
Assuming this issue would have existed for years and staying conservative towards cutting the RC I did not included in the 4.15.2 milestone. Therefore pl discuss and if it's the case change base branch to main. One concern is what if allowing public traffic via pg causes some regression or security issue? |
@ravening can you share the iptables rules which contains the device for private gateway in VR ?
|
Hi @ravening |
|
@weizhouapache below are the details |
|
I want to be clear about
|
without any code change, the ping from vm to dedicated server works but ping from dedicated server to internet doesnt work if i make both public ip and gateway 10.32.22.125 in cloudstack then ping from decdicated server to internet works but ssh from vm to dedicated server doesnt work (ping still works) with this code change both scenarios works |
@ravening it should be caused by ACL rules. |
should I add this to all tiers? I tested the ssh connection from the "admin tier" which has the below acl rule 100 : cidr 0.0.0.0/0 icmp -1 -1 allow all direction: ingress 1000: cidr 0.0.0.0/0 action : deny protocol: all direction: ingress |
@ravening I think you need to change the ACL rules of private gateway, not VPC tiers. |
@weizhouapache you mean to say add static routes under the private gateay? |
@ravening no. when you add a private gateway, you can specify a network ACL. you need to add rules in ACL. |
@ravening yes. if ping works (from vm to dedicated server and dedicated server to internet), VPC VR should be ok, then you need to check ACL rules. |
@weizhouapache This is the test I did made both private gateway and public ip end with .125 result:
|
@ravening can you share the iptables rules (ACL_INBOUND and ACL_OUTBOUND) ? |
|
inbound outbound |
|
@ravening can you add egress rules in ACL of vm tiers? does vm have static nat IP ?
|
after this changes, even the ssh from dedicated server to cloudstack vm also stopped |
@weizhouapache yes it has the static nat ending with 34 and its internal ip address is 10.69.3.1 |
@ravening can you ping/ssh from a vm without static nat ? |
@weizhouapache unfortunately I dont have access to the vm without static nat |
@ravening it would be good to create a test vm in same vpc tier. might be related to #4484 |
@weizhouapache yes i can ssh/ping from a vm without a static nat |
@ravening |
@weizhouapache yes we already have this code in our branch |
@weizhouapache we tested the same scenario in our test setup and the ping/ssh worked fine after applying this code change. without this change, it didnt work |
@ravening |
@weizhouapache no, the gateway and public IP are different. |
@ravening |
yes these rules are applied only when public ip and gateway are same.... but in our case they are different.
we have added all ingress and egress but still no ping |
@ravening |
@weizhouapache ok. thanks for the help... will see what else we can find out |
@ravening |
@weizhouapache we found out the issue. the rule has to be added the beginning by passing "front" in the command. so this is what we tested
i will make the code change and update the pr |
When private gateway is configured, the external server which are connected through private gateway cannot send traffic to outside world. Add a source iptable rule so that the servers which are connected through private gateway can ping the public IP's
ravening
force-pushed
the
private-gateway-ping
branch
from
cfbe1ba to
685d299
Compare
|
@weizhouapache @rhtyd updated code |
| (self.address["network"], address["network"], address["device"])]) | ||
| # Accept packet from private gateway if VPC VR is used as gateway | ||
| self.fw.append(["filter", "", "-A FORWARD -s %s ! -d %s -j ACCEPT" % | ||
| self.fw.append(["filter", "front", "-A FORWARD -s %s ! -d %s -j ACCEPT" % |
There was a problem hiding this comment.
@ravening
can you move this to line 497 and test it ?
There was a problem hiding this comment.
@ravening
without front might not fix your problem. try with front
There was a problem hiding this comment.
@weizhouapache still works... the rule is still being added at the beginning of the FORWARD chain
There was a problem hiding this comment.
@weizhouapache yes
# iptables -L FORWARD --line-numbers
Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 10.32.18.192/27 !10.32.18.192/27
2 ACL_INBOUND_eth3 all -- 10.32.18.192/27 10.0.0.0/24
3 ACL_INBOUND_eth2 all -- 10.0.0.0/24 10.32.18.192/27
4 ACL_INBOUND_eth4 all -- 10.32.18.192/27 10.0.1.0/24
5 ACL_INBOUND_eth2 all -- 10.0.1.0/24 10.32.18.192/27
There was a problem hiding this comment.
@ravening
as you see in the rules, rule 2 and 4 will always be ignored.
can you send me the whole iptables rules by email (no matter if this PR is applied) ?
|
@ravening could you please confirm if this can be closed ? |
@weizhouapache closing this as we need to configure extra firewall rules when compares to regular cases |
3 participants
Description
When private gateway is configured, the external server
which are connected through private gateway cannot send
traffic to outside world. Add a source iptable rule so
that the servers which are connected through private gateway
can ping the public IP's
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?