Page History

Introduction

Allow ACL service on private gateway feature is part of the nTier Apps 2.0.

Currently we don't have mechanism to filter to/from traffic on the private gateway interface.

Using this feature we can control the traffic by creating Ingress/Egress network ACLs on the VPC private gateway.

The ACLs contains both ALLOW and DENY rules.

Bug Reference: 

CLOUDSTACK-768

...

To add Ingress/Egress rules we can make use of the existing vpc_acl.sh script.

API changes:

API:

replaceNetworkACLList:

Wiki MarkupreplaceNetworkACLList API taken from the support acl  deny rules FS \[1\support acl  deny rules FS [1].

New parameter to the APIs: gatewaiId

Currently networkId is required parameter. NetworkId will be made optional. New optional parameter gatewaiId will be added to these APIs.

Only one of above parameters is mandatory

API:

While creating private gateway we can map network acl id to the private gateway. For this a new param to createPrivateGateway API is added.

If acl id not passed then private gateway will be associated with default BLOCK acl id.

createPrivateGateway:

New parameter: 

...