Hi,

The ACL section of the ovn-nb.5.html man page states:

*m**a**t**c**h*: string
...
...
...

              Note  that  you  can  not  create an ACL matching on a port with
              type=router or type=localnet.



Yet this is not what I see, it seems that ACLs work on localnet ports, I have:


ls_vcn5185721_external_ugw
    port ls_vcn5185721_external_ugw-lr_vcn5185721
        type: router
        router-port: lr_vcn5185721-ls_vcn5185721_external_ugw
    port ln-ls_vcn5185721_external_ugw
        type: localnet
        addresses: ["unknown"]


And an ACL:
  to-lport 32767 (outport == "ln-ls_vcn5185721_external_ugw" && (icmp4.type == 
3 || icmp4.type == 11)) allow-related
  to-lport 32767 (outport == "ln-ls_vcn5185721_external_ugw" && (ip4.dst == 
169.254.169.254 && tcp.dst == 80)) drop log(name=vcn-ugw-def-2,severity=info)
  to-lport 32767 (outport == "ln-ls_vcn5185721_external_ugw" && arp) 
allow-related
  to-lport 32766 (outport == "ln-ls_vcn5185721_external_ugw" && (ip4.dst == 
$vcn5185721_allowed_underlay) && (tcp.dst == 53 || tcp.dst == 443 || tcp.dst == 8443 || udp.dst 
== 53 || tcp.dst == 123 || udp.dst == 123)) allow-related
  to-lport     0 (outport == "ln-ls_vcn5185721_external_ugw") drop 
log(name=vcn-ugw-def-4,severity=info)


And the ACL is working, am I missing something, is the man page incorrect?


Thanks

Brendan
_______________________________________________
discuss mailing list
disc...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-discuss

Reply via email to