ACLs on private GW

Introduction

Allow ACL service on private gateway feature is part of the nTier Apps 2.0.

Currently we don't have mechanism to filter to/from traffic on the private gateway interface.

Using this feature we can control the traffic by creating Ingress/Egress network ACLs on the VPC private gateway.

Bug Reference: 

CLOUDSTACK-768

API changes:

The existing network ACL APIs are used to configure the network ACLs on the VPC private gateway.

createNetworkACL - create Netowrk ACL

deleteNetworkACL - delete network ACL

listNetworkACLs - list network ACLs

New parameter to the APIs: gatewaiId

Currently networkId (id of the guest network) is required parameter. NetworkId will be made optional. New optional parameter gatewaiId will be added to these APIs.

One and only one of above parameters is mandatory

DB Chagnes:

A new column 'gatewayId' is added to the firewall_rules table.

Design:

Default Network ACL policy:

Ingress : All the ingress traffic to the into the private gateway interface are blocked.

Egress : All the egress traffic out from the private gateway interface are blocked

To add Ingress/Egress rules we can make use of the existing vpc_acl.sh script.

itpables rules chagnes:

When ever private gateway interface get create on the router.we also add the following iptables chains.

Assume eth3 is the private gateway interface on the router.

Filter table:

 -A FORWARD -i eth3 -j ACL_INBOUND_eth3

Mangle table:

-A PREROUTING -o eth3  -j ACL_OUTBOUND_eth3.

ACL_INBOUND_eth3 - This chain contains the all the INGRESS rules on the

ACL_OUTBOUND_eth3 - This chain contains the all the EGRESS rules

UI changes:

Network-> Network-VPC -><vpcName> ->ConfigureVPC:<vpcname>PrivateGateway-><GatewayIp>

When we click on the private gateway we have currently two tabs, 1. Details 2.Static Routes. Add NetworkACL tab after the static routes.

The configuration parameters for the network ACL are  protocol, ports, CIDR and traffic Type (Ingress/Egress).

Upgrade:

On upgrade the for existing private gateways all the Ingress/Egress traffic is allowed which is to pertain the pre upgrade behaviour.