===== COMMAND =====: iptables -t filter -S
===== RETURN CODE =====: 0
===== STDOUT =====:
[10.109.0.6] out: -P INPUT ACCEPT
[10.109.0.6] out: -P FORWARD ACCEPT
[10.109.0.6] out: -P OUTPUT ACCEPT
[10.109.0.6] out: -N neutron-filter-top
[10.109.0.6] out: -N neutron-openvswi-FORWARD
[10.109.0.6] out: -N neutron-openvswi-INPUT
[10.109.0.6] out: -N neutron-openvswi-OUTPUT
[10.109.0.6] out: -N neutron-openvswi-i80c7caf9-2
[10.109.0.6] out: -N neutron-openvswi-local
[10.109.0.6] out: -N neutron-openvswi-o80c7caf9-2
[10.109.0.6] out: -N neutron-openvswi-s80c7caf9-2
[10.109.0.6] out: -N neutron-openvswi-sg-chain
[10.109.0.6] out: -N neutron-openvswi-sg-fallback
[10.109.0.6] out: -A INPUT -j neutron-openvswi-INPUT
[10.109.0.6] out: -A INPUT -p icmp -m comment --comment "000 accept all icmp requests" -j ACCEPT
[10.109.0.6] out: -A INPUT -i lo -m comment --comment "001 accept all to lo interface" -j ACCEPT
[10.109.0.6] out: -A INPUT -m comment --comment "002 accept related established rules" -m state --state RELATED,ESTABLISHED -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.0.2/32 -p tcp -m multiport --sports 4369,5672,41055,55672,61613 -m comment --comment "003 remote rabbitmq " -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.0.2/32 -p tcp -m multiport --sports 8140 -m comment --comment "004 remote puppet " -j ACCEPT
[10.109.0.6] out: -A INPUT -i lo -p tcp -m multiport --sports 15672 -m comment --comment "005 local rabbitmq admin" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --sports 15672 -m comment --comment "006 reject non-local rabbitmq admin" -j DROP
[10.109.0.6] out: -A INPUT -p tcp -m multiport --dports 6800:7100 -m comment --comment "011 ceph-osd allow" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.0.0/24 -p tcp -m multiport --ports 22 -m comment --comment "020 ssh from 10.109.0.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 22 -m comment --comment "020 ssh from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.4.0/24 -p tcp -m multiport --ports 22 -m comment --comment "020 ssh from 10.109.4.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 240.0.0.2/32 -p tcp -m comment --comment "030 allow connections from haproxy namespace" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 80,443 -m comment --comment "100 http" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 3306,3307,4567,4568,49000 -m comment --comment "101 mysql from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -d 10.109.2.0/24 -p tcp -m multiport --ports 5000,35357 -m comment --comment "102 keystone" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 8080,6000,6001,6002,49001 -m comment --comment "103 swift" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 9292,9191,8773 -m comment --comment "104 glance" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 8774,8776,6080 -m comment --comment "105 nova" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 8775,5900:6100 -m comment --comment "105 nova internal - no ssl from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 4369,5672,5673,41055 -m comment --comment "106 rabbitmq from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 11211 -m comment --comment "107 memcache tcp from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 11211 -m comment --comment "107 memcache udp from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 873 -m comment --comment "108 rsync from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.4.0/24 -p tcp -m multiport --ports 873 -m comment --comment "108 rsync from 10.109.4.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.4.0/24 -p tcp -m multiport --ports 3260 -m comment --comment "109 iscsi from 10.109.4.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 9696 -m comment --comment "110 neutron" -j ACCEPT
[10.109.0.6] out: -A INPUT -p udp -m multiport --ports 67 -m comment --comment "111 dhcp-server" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 53 -m comment --comment "111 dns-server tcp from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 53 -m comment --comment "111 dns-server udp from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 123 -m comment --comment "112 ntp-server from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 5404 -m comment --comment "113 corosync-input from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 5405 -m comment --comment "114 corosync-output from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 2224 -m comment --comment "115 pcsd-server from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 58882 -m comment --comment "116 openvswitch db from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.0.0/24 -p udp -m multiport --ports 5666 -m comment --comment "117 nrpe-server from 10.109.0.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p udp -m multiport --ports 5666 -m comment --comment "117 nrpe-server from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 16509 -m comment --comment "118 libvirt from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -s 10.109.2.0/24 -p tcp -m multiport --ports 49152:49215 -m comment --comment "119 libvirt-migration from 10.109.2.0/24" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 8777 -m comment --comment "121 ceilometer" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 8004 -m comment --comment "204 heat-api" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 8000 -m comment --comment "205 heat-api-cfn" -j ACCEPT
[10.109.0.6] out: -A INPUT -p tcp -m multiport --ports 8003 -m comment --comment "206 heat-api-cloudwatch" -j ACCEPT
[10.109.0.6] out: -A INPUT -p gre -m comment --comment "334 accept gre" -j ACCEPT
[10.109.0.6] out: -A INPUT -p udp -m multiport --ports 4789 -m comment --comment "340 vxlan_udp_port" -j ACCEPT
[10.109.0.6] out: -A INPUT -m comment --comment "999 drop all other requests" -j DROP
[10.109.0.6] out: -A FORWARD -j neutron-filter-top
[10.109.0.6] out: -A FORWARD -j neutron-openvswi-FORWARD
[10.109.0.6] out: -A OUTPUT -j neutron-filter-top
[10.109.0.6] out: -A OUTPUT -j neutron-openvswi-OUTPUT
[10.109.0.6] out: -A neutron-filter-top -j neutron-openvswi-local
[10.109.0.6] out: -A neutron-openvswi-FORWARD -m physdev --physdev-out tap80c7caf9-2b --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
[10.109.0.6] out: -A neutron-openvswi-FORWARD -m physdev --physdev-in tap80c7caf9-2b --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
[10.109.0.6] out: -A neutron-openvswi-INPUT -m physdev --physdev-in tap80c7caf9-2b --physdev-is-bridged -m comment --comment "Direct incoming traffic from VM to the security group chain." -j neutron-openvswi-o80c7caf9-2
[10.109.0.6] out: -A neutron-openvswi-i80c7caf9-2 -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
[10.109.0.6] out: -A neutron-openvswi-i80c7caf9-2 -s 10.109.3.2/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
[10.109.0.6] out: -A neutron-openvswi-i80c7caf9-2 -s 10.109.3.3/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
[10.109.0.6] out: -A neutron-openvswi-i80c7caf9-2 -m set --match-set NIPv4daa401bc-6b48-43b5-8656- src -j RETURN
[10.109.0.6] out: -A neutron-openvswi-i80c7caf9-2 -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
[10.109.0.6] out: -A neutron-openvswi-i80c7caf9-2 -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -p udp -m udp --sport 68 -m udp --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -j neutron-openvswi-s80c7caf9-2
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -p udp -m udp --sport 67 -m udp --dport 68 -m comment --comment "Prevent DHCP Spoofing by VM." -j DROP
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -j RETURN
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
[10.109.0.6] out: -A neutron-openvswi-o80c7caf9-2 -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
[10.109.0.6] out: -A neutron-openvswi-s80c7caf9-2 -s 10.109.3.4/32 -m mac --mac-source FA:16:3E:E1:13:96 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
[10.109.0.6] out: -A neutron-openvswi-s80c7caf9-2 -m comment --comment "Drop traffic without an IP/MAC allow rule." -j DROP
[10.109.0.6] out: -A neutron-openvswi-sg-chain -m physdev --physdev-out tap80c7caf9-2b --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-i80c7caf9-2
[10.109.0.6] out: -A neutron-openvswi-sg-chain -m physdev --physdev-in tap80c7caf9-2b --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-o80c7caf9-2
[10.109.0.6] out: -A neutron-openvswi-sg-chain -j ACCEPT
[10.109.0.6] out: -A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
[10.109.0.6] out: 

===== STDERR =====:
