ACL Deny Rules

Currently only ACL allow rules are supported as part of Network ACLs. Default is to block all incoming and all outgoing traffic between tiers and between tiers and various gateways (including Public).  ACL deny rules will be supported through this feature. New fields "number"  and "action"will be added to rules to resolve conflicting rules. After rule creation, its number can be modified. NetworkACLs will be evaluated in the order of its number starting from lowest. Action of the first matching rule is applied.  

NetworkACLContainer will be introduced to manage NetworkACLs.

NetworkACLContainer

NetworkACLContainer is a numbered list of  NetworkACLs that are evaluated in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any tier associated with the network ACL.

Instead of adding NetworkACLs directly to the tier, NetworkACLs will be added to the NetworkACLContainer. NetworkACLContainer can be assigned to multiple vpc tiers. Each tier can be associated with only one NetworkACLContainer. 

Default NetworkACLContainer

Each tier upon creation will be associated with default NetworkACLContainer.

Add/Remove networkACL to container

NetworkACLs can be added to or removed from the container using APIs createNetworkACL and removedNetworkACL APIs.

API changes

Existing API

createNetworkAcl

• New parameters
  •  action (required) - allow/deny
  • number (required) - rule number. ACL rules are ordered by this number
  • container_id (optional) - id of the network ACL container

new API

updateNetworkACL

• Parameters:**  id (required) - Id of the network ACL ** trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified)** cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0
  • startPort (optional)
  • endPort (optional)
  • protocol (optional). TCP/UDP/ICMP protocol types are supported
  • icmpType (optional) - type of the icmp message being sent
  • icmpCode (optional) - error code for this icmp message
  • action (optional) - allow/deny
  • number (optional) - rule number 

createNetworkAclContainer

Parameters:

• name - Name of the Network Acl Container (required)
• description - Description of the Network ACL Container (required)

Response:

• name - Name of the Network Acl Container
• id - Id of the Network Acl ContainerdeleteNetworkAclContainer

Parameters:

• id - Id of the Network Acl Container (required)

Response:

• success - True if Network ACL container is successfully removed, false otherwise

listNetworkAclContainers

Parameters:

• id - Id of the Network Acl Container (optional)
• network_id - list by network_id (Tier) (optional)

Response:

• success - True if Network ACL container is successfully removed, false otherwise

replaceACLContainerAssociation

Parameters:

• network_id - Id of the network (Tier) (required)
• container_id: Id of the network ACL container to be associated with the network (required)

Response:

• success -  True when container is successfully assigned to network, false otherwise

DB

New columns in firewall_rules table:

• action (String)
• number (long)

action and number will be mandatory for rule with purpose NetworkACL.

Upgrade:

All existing rules in firewall_rules table of type NetworkACL will have action "allow". Rule number will be sequentially assigned for all rules in each network.