FWaaS - New blocking rules has no affect for existing traffic
Bug #1386543 reported by
Itzik Brown
This bug report is a duplicate of:
Bug #1474279: FWaaS let connection opened if delete allow rule, beacuse of conntrack.
Edit
Remove
This bug affects 2 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| neutron |
New
|
Undecided
|
Unassigned | ||
Bug Description
When building a firewall with a rule to block a specific Traffic - the current traffic is not blocked.
For example:
Running a Ping to an instance and then building a firewall with a rule to block ICMP to this instance doesn't have affect while the ping command is still running.
Exiting the command and then trying pinging the Instance again shows the desired result - i.e. the traffic is blocked.
This is also the case for SSH.
Revision history for this message
| Sumit Naiksatam (snaiksat) wrote | #1 |
| Changed in neutron: | |
| status: | New → Triaged |
| assignee: | nobody → badveli_vishnuus (badveli-vishnuus) |
| Changed in neutron: | |
| importance: | Undecided → High |
Revision history for this message
| badveli_vishnuus (badveli-vishnuus) wrote | #2 |
| tags: | added: fwaas |
Revision history for this message
| fangzhen (zhen-fang) wrote | #3 |
| Changed in neutron: | |
| assignee: | badveli_vishnuus (badveli-vishnuus) → nobody |
| status: | Triaged → New |
| status: | New → Incomplete |
| importance: | High → Undecided |
| status: | Incomplete → New |
| status: | New → Incomplete |
Revision history for this message
| Itzik Brown (itzikb1) wrote | #4 |
| Changed in neutron: | |
| status: | Incomplete → New |
To post a comment you must log in.
This is related to the use of the underlying iptables library. A similar bug has been filed for SG:
https:/
A common solution will work in both cases.