Repository navigation
Support firewall rules on Public IP in VPC #8863
Description
ISSUE TYPE
- Improvement Request
COMPONENT NAME
Improvement Request (UI, Functionality)
CLOUDSTACK VERSION
4.19
CONFIGURATION
N/A
OS / ENVIRONMENT
N/A
SUMMARY
Note: This ticket is broken down as requested from the origianl post, #8841
Support ACL on Public IP
- According to Terraform docs, it seems that this is possible: https://registry.terraform.io/providers/cloudstack/cloudstack/latest/docs/resources/firewall
- However, i cant seem to find this in the GUI. So in case this is not available in the GUI, would like to request to make this available.
STEPS TO REPRODUCE
N/A
N/A
EXPECTED RESULTS
To be able to manage ACL Rules more easily for large scale projects
ACTUAL RESULTS
Challenging to use ACL rules for large scale projects.
Activity
DaanHoogland commentedon Apr 11, 2024
@btzq , if we implement #8864 , the firewall functionality will be supported by virtue of the private IPs. The user facing functionality will be somewhat different but the security features will be the same. A user wanting to set access lists into a VPC will have to know about its topology anyway. What do you think?
btzq commentedon Apr 12, 2024
@DaanHoogland when you mean topopology, do you mean that the users will need to know the existance of a the Virtual Router?
DaanHoogland commentedon Apr 12, 2024
yes, but mostly the mapping of private IPs to static NAT Ips and individual services mapped from other IPs to the backends.
bad example:
public 10.10.10.10 - source NAT
public 10.10.10.11 - static NAT to private 10.11.12.10
public 10.10.10.12 - port 80 loadbalanced over 10.11.13.10 and 10.11.13.11
etc.
btzq commentedon Apr 12, 2024
Hmm this is my opinion but i think part of the beauty of having cloud is that the customer does not need to know the topology of the underlying cloud service/infra. If the customer needs to learnt he existance of a router, it might complicate things for them and deter them from using the service.
[-]Support ACL on Public IP[/-][+]Support firewall rules on Public IP in VPC[/+]8 remaining items
OVN plugin: complete the auto-seeded OVN offerings for fresh installs
OVN plugin: complete the auto-seeded OVN offerings for fresh installs
OVN plugin: complete the auto-seeded OVN offerings for fresh installs