Page History

Introduction

Allow ACL service on private gateway feature is part of the nTier Apps 2.0.

Currently we don't have mechanism to filter to/from traffic on the private gateway interface.

Using this feature we can control the traffic by creating Ingress/Egress network ACLs on the VPC private gateway.

The ACLs contains both ALLOW and DENY rules.

Bug Reference: 

CLOUDSTACK-768

...

To add Ingress/Egress rules we can make use of the existing vpc_acl.sh script.

API changes:

API:

replaceNetworkACLList:

Wiki MarkupreplaceNetworkACLList API taken from the support acl  deny rules FS \[1\support acl  deny rules FS [1].

New parameter to the APIs: gatewaiId

Currently networkId is required parameter. NetworkId will be made optional. New optional parameter gatewaiId will be added to these APIs.

Only one of above parameters is mandatory

API:

While creating private gateway we can map network acl id to the private gateway. For this a new param to createPrivateGateway API is added.

If acl id not passed then private gateway will be associated with default BLOCK acl id.

createPrivateGateway:

New parameter: 

aclid (otional) - Id of the network calacl 

createPrivateGateway API Response updated:

API response updated with the aclid of the private gateway it associated.

Note: The list of  aclid's can be obtained using the API 'listNetworkACLLists'

Work Flow:

1. create private gateway
2. While creating user can pass acl id to API, if not by default private gateway associated with default BLCOK networkACL
3. Add network ACL items into networkACL. These networkACL items (ACL rules) get applied to the private gateway.

...