fwaas:Firewall in "active" status is not working when there is no external g/w to the router
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
Fix Released
|
High
|
Rajesh Mohan | ||
Icehouse |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Steps to Reproduce:
Actual Results:
Expected Results:
tags: | added: fwaas |
Changed in neutron: | |
importance: | Undecided → High |
assignee: | nobody → Sumit Naiksatam (snaiksat) |
milestone: | none → juno-1 |
Changed in neutron: | |
assignee: | Sumit Naiksatam (snaiksat) → Rajesh Mohan (rajesh.mohan) |
tags: | added: icehouse-backport-potential |
Changed in neutron: | |
status: | Fix Committed → Fix Released |
tags: | removed: icehouse-backport-potential |
Changed in neutron: | |
milestone: | juno-1 → 2014.2 |
In process_router(), IPtables apply is deferred (as per commit message, this is done to improve performance).
https:/ /github. com/openstack/ neutron/ blob/master/ neutron/ agent/l3_ agent.py# L418
When ext_gw is present, it is turned off (to enable NAT rules). We could do something similar when firewall is enabled on the router.
Since Fwaas driver was originally designed as perimeter firewall, this was always tested with external gateway and we did not see this issue.
I will post a patch with apply_defer_off() in the firewall path.