DaanHoogland commented on PR #13684: URL: https://github.com/apache/cloudstack/pull/13684#issuecomment-5239402126
> > > @weizhouapache thing that there is a misunderstanding here: from what I know (worth testing....) the default DENY rule applies only until someone adds a very first egress rule (any) - after that - if they want to allow just some outgoing/egress traffic and notall, there is no more "default/failback" DENY rule exising, it has to be explicitly added. > > > > > > afaik, if egress policy is DENY, the REJECT rule is always the last rule in the iptables chain, the other rules in the chain are ACCEPT-ed. Similarly, if egress policy is ALLOW, the ACCEPT rule is the last while other rules are REJECT-ed. I will test tomorrow. > > confirmed. > > (use the default network offering with egress policy=false) > > * no rules > > ``` > root@r-628-VM:~# iptables-save |grep FW_ > -A FORWARD -i eth0 -o eth2 -j FW_OUTBOUND > -A FW_EGRESS_RULES -j DROP > -A FW_OUTBOUND -m state --state RELATED,ESTABLISHED -j ACCEPT > -A FW_OUTBOUND -j FW_EGRESS_RULES > ``` > > * affer adding a rule to allow port 22 and 1.2.3.4/32 > > ``` > root@r-628-VM:~# iptables-save |grep FW_ > -A FORWARD -i eth0 -o eth2 -j FW_OUTBOUND > -A FW_EGRESS_RULES -p tcp -m set --match-set destCidrIpset-971 dst -m tcp --dport 22 -j ACCEPT > -A FW_EGRESS_RULES -j DROP > -A FW_OUTBOUND -m state --state RELATED,ESTABLISHED -j ACCEPT > -A FW_OUTBOUND -j FW_EGRESS_RULES > ``` does this mean lgty and tested, @weizhouapache ? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
