east and west traffic is not allowed/blocked with neutron fwaas v2
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
New
|
Undecided
|
Unassigned |
Bug Description
When trying to block network traffic in same subnet, it didn't work.
I will explain details below:
1. firstly create 2 networks,subnets
you can see network details in there: https:/
2. create a router and connect subnets to this router:
you can see router details in there: https:/
3. Create 3 vms and 2 of them is are in same subnet:
you can see vm details in there:https:/
4. create firewall rules for blocking network traffic from same subnets and different subnets
You can see firewall rule details in there: https:/
5. create ingress and eggress firewall policies and add rules.
You can see firewall policy details in there: https:/
6. create firewall group.
you can see firewall group details in there: https:/
Result:
1. friewall rules worked between different subnets. For example in rules icmp traffic is blocked from 192.168.30.83 to 172.16.30.20. it is worked as expected.
2. friewall rules didn't work between same subnets. For example in rules icmp traffic is blocked from 192.168.30.83 to 92.168.30.175. it didn't work. we can ping.
OpenStack Version: 2023.1
Linux Distro: Ubuntu 22.04
Neutron Plugin: ML2+OVS
tags: | added: neutron-fwaas |
summary: |
- east and west traffic is not allowed/blocked with neutron fwaa v2 + east and west traffic is not allowed/blocked with neutron fwaas v2 |
Hi Gokhan,
I would have to set this up to confirm but the reproduction steps are pretty clear, thank you. I am not fwaas plugin expert, so I would have to first confirm if this is perhaps an expected result? Same linux bridge and hence no L3 needed? Just guessing
Did this work for you in previous releases or is this the first time you are trying to set this up?
Also what is your overall goal? Why do you want to block traffic between VMs on the same subnet?