netsec needs machine firewall for some providers

[William Reade]

open_port, close_port, and get_opened_ports just log a warning and pretend to succeed; this is not good enough for production

[Kapil Thangavelu (hazmat)]

This should probably delegate to the machine agent so we can implement once for all using machine level firewalling.. also gets rids of multi-second slowness for bootstrap/addmachine/remove-machine/and destroy-environment.

[Clint Byrum (clint-fewbar)]

The reasons for doing this are piling u p.

* As the dupe bug #996857 states, not having this means things tested on LXC won't work the same on EC2

* We are basically abusing security groups in EC2 by giving every node its own group. Because of the way EC2 works, having to put everynode in a group at launch time, its just not dynamic enough. This also has been a source of difficulty in working with OpenStack.

[Clint Byrum (clint-fewbar)]

bug #1027641 regarding the openstack provider is related

[Dave Cheney (dave-cheney)]

I am not sure this is an issue anymore for juju-core as we are more sensible with our firewall setup.

[Kapil Thangavelu (hazmat)]

On Sun, Jan 13, 2013 at 11:22 PM, Dave Cheney <email address hidden>wrote:

> I am not sure this is an issue anymore for juju-core as we are more
> sensible with our firewall setup.

its nice to be explicit.. ie. juju-core supports machine level iptable
firewalls.

[William Reade (fwereade)]

This is still an issue. The firewally stuff has hopefully been implemented in such a way that adding machine-level iptables firewalling will not be too challenging; but it has not actually been done.

[Kapil Thangavelu (hazmat)]

atm this is specifically needed for maas and rackspace.