Repository navigation
Reordering ACL rules inside the ACL list - does not apply the rule order inside the VR #9398
Description
ISSUE TYPE
- Bug Report
COMPONENT NAME
UI (maybe also API)
CLOUDSTACK VERSION
4.19.1.0-SNAPSHOT
CONFIGURATION
OS / ENVIRONMENT
SUMMARY
Using DRAG&DROP to arrange ACL rules order inside ACL list, doesn't apply rules inside the VR (the ACL list is already attached to a VPC network) The workaround is to change ACL list for this network to another ACL list and then go back and reapply previously used ACL list.
STEPS TO REPRODUCE
Before changing the order of rules outgoing traffic to port 80 is allowed.
After putting the DENY rule above the port 80 rule, the outgoing traffic to port 80 is still allowed - see the screenshots bellow
EXPECTED RESULTS
At least - show the message in the UI (API output) that the ACL list needs to be reapplied.
ACTUAL RESULTS
Activity
DaanHoogland commentedon Jul 16, 2024
@s-novakovic did you try restarting the network with cleanup?
btzq commentedon Jul 17, 2024
@DaanHoogland i think this issue is very similar to the one we discussed in #8865
DaanHoogland commentedon Jul 17, 2024
ok, in that case can you check with the new RC for 4.19.1? #9119 could have solved it.
s-novakovic commentedon Jul 17, 2024
Yes @DaanHoogland after restarting the network the rules get applied and it works as expected. Maybe we should add a message in the UI/API output, something like "you might need to restart the network for the rules to get applied" or something similar. I we'll check to behavior in the new RC and we'll let you know. Thank you
DaanHoogland commentedon Jul 17, 2024
Well @s-novakovic , we could add a message, but I think your initial expectations are not wrong. I just saw you had used a snapshot 4.19.1 version. Can you check if that included #9119 ?
s-novakovic commentedon Jul 17, 2024
@DaanHoogland, I have checked the #9119 and it only modifies 2 UI-based files (.js and .vue), so it can't be fixing it...?
However, I have managed to somehow upgrade from 4.19.1.0-snapshot to the 4.19.1.0-RC2 and it still doesn't work.
Will try a clean RC2 install and let you know if there are any changes.
s-novakovic commentedon Jul 24, 2024
I've managed to test this on the RC2/final 4.19.1.0 version - and the issue is still there. It seems that only the DB records get updated (the order of rules for the ACL list) - but we never check if the ACL list is already attached to a network - and thus we never update the rules inside the VR.
It would be good if we do a check "if ACL is used/attached to a network --> do some nice message that network needs to be restarted (there is no cleanup option for the VPC network, so it's not disruptive and it's a quick action).
10 remaining items
Curverneur commentedon Jan 15, 2026
Hi, we noticed this behaviour as well and did some tests. Version: 4.22.0
Example:
How it doesn't work:
If I try to swap the rule
10.0.0.0/8with192.168.1.0/24by using the "move" icon (drag&drop), the page refreshes asap and the ui shows changed rule numbers:Checking the VirtualRouter indicates no change:
Reverting the change in the ui to get back to the starting position:
How it works:
Changing the rule number of
192.168.1.0/24from 4 to 2 to move it before10.0.0.0/8using the edit button:--> you notice, that the page takes longer to save
--> the rule numbers changed in the VirtualRouter:
Summary:
Changing the rule number of an ACL Rule (live) only works by using the edit button. Changes by Terraform (if rule_number is set) are applied to the VirtualRouter as expected.
Apply reordered ACL list to VR router (#12525)
shwstppr commentedon Jan 28, 2026
Fixed by #12525
Apply reordered ACL list to VR router (apache#12525)
Apply reordered ACL list to VR router (apache#12525)