prashanthr2 opened a new issue, #14518:
URL: https://github.com/apache/cloudstack/issues/14518
### problem
In an advanced zone with security groups, if a shared guest network uses the
same VLAN on the same physical device as the public network, both resolve to
the same Linux bridge (breth1-51 here). The first security-grouped user VM on a
host installs the bridge firewall framework on that bridge, including two
catch-all rules:
```
-A FORWARD -o breth1-51 -j DROP
-A FORWARD -i breth1-51 -j DROP
```
The SSVM and CPVM have their public NICs on that same bridge but are never
programmed into the framework, so every new inbound flow to them is dropped.
Established connections survive only while they stay in conntrack via the
RELATED,ESTABLISHED rule in BF-breth1-51, which is why it looks like it works
for a while and then breaks.
Packet path for a new inbound connection to the system VM:
```
FORWARD -> BF-breth1-51 -> not RELATED,ESTABLISHED
-> BF-breth1-51-OUT (empty, no match)
-> --physdev-out <uplink> ACCEPT (no match, physdev-out is vnetX)
-> falls through to "-A FORWARD -o breth1-51 -j DROP"
```
### versions
The versions of ACS, hypervisors, storage, network etc..
### The steps to reproduce the bug
1.
2.
3.
...
### What to do about it?
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
