etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

VPC : acl works

This commit is contained in:
anthony 2012-06-22 18:01:22 -07:00
parent 05332128e9
commit 583c8ad979
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
patches/systemvm/debian/config/etc/iptables/iptables-vpcrouter
View File

@ -21,5 +21,6 @@ COMMIT
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p udp --dport bootpc -j CHECKSUM --checksum-fill
COMMIT

8
patches/systemvm/debian/config/opt/cloud/bin/vpc_acl.sh
View File

@ -69,7 +69,7 @@ acl_chain_for_guest_network () {
# outbound
sudo iptables -N ACL_OUTBOUND_$ip 2>/dev/null
sudo iptables -A ACL_OUTBOUND_$ip -j DROP 2>/dev/null
sudo iptables -D FORWARD -i $dev -s $gcidr -j ACL_OUTBOUND_$ip 2>/dev/null
sudo iptables -A FORWARD -i $dev -s $gcidr -j ACL_OUTBOUND_$ip 2>/dev/null
}
@ -84,9 +84,9 @@ acl_entry_for_guest_network() {
local cidrs=$(echo $rule | cut -d: -f5 | sed 's/-/ /g')
if [ "$sport" == "0" -a "$eport" == "0" ]
then
DPORT = ""
DPORT=""
else
DPORT = "--dport $sport:$eport"
DPORT="--dport $sport:$eport"
fi
logger -t cloud "$(basename $0): enter apply acl rules for guest network: $gcidr, inbound:$inbound:$prot:$sport:$eport:$cidrs"
@ -115,7 +115,7 @@ acl_entry_for_guest_network() {
$DPORT -j ACCEPT
else
sudo iptables -I ACL_OUTBOUND_$ip -p $prot -d $lcidr \
$DPORT -j ACCEP
$DPORT -j ACCEPT
fi
fi
result=$?