Open ports cannot be restricted to an IP or domain

[Nate Finch]

Right now, if you open a port on a node to the outside network, it's open to the entire network - there's no way to just expose it to a limited audience.

Reported here: http://askubuntu.com/questions/448444/juju-security-model-issues

[William Grant (wgrant)]

This is pretty inconvenient when combined with the lack of intra-environment isolation. If you have some slightly untrustworthy services, the free-for-all security groups within an environment mean you need to have them in a separate one. But that requires that you expose some services from the trusted environment, and this bug means you then need to firewall them manually.

Something like "juju expose --to NETWORK/MASK" might work, though in my specific case I need a private API port to be restricted while a webapp port on the same service should be public.

[Anastasia (anastasia-macmood)]

Re-targeting for Juju 2.

[Ian Booth (wallyworld)]

The work to enable ports to be exposed to a CIDR range or a network space landed in 2.9