weizhouapache commented on PR #13684:
URL: https://github.com/apache/cloudstack/pull/13684#issuecomment-5201947750

   > > @weizhouapache thing that there is a misunderstanding here: from what I 
know (worth testing....) the default DENY rule applies only until someone adds 
a very first egress rule (any) - after that - if they want to allow just some 
outgoing/egress traffic and notall, there is no more "default/failback" DENY 
rule exising, it has to be explicitly added.
   > 
   > afaik, if egress policy is DENY, the REJECT rule is always the last rule 
in the iptables chain, the other rules in the chain are ACCEPT-ed. Similarly, 
if egress policy is ALLOW, the ACCEPT rule is the last while other rules are 
REJECT-ed. I will test tomorrow.
   
   confirmed.
   
   (use the default network offering with egress policy=false)
   
   - no rules
   
   ```
   root@r-628-VM:~# iptables-save |grep FW_
   -A FORWARD -i eth0 -o eth2 -j FW_OUTBOUND
   -A FW_EGRESS_RULES -j DROP
   -A FW_OUTBOUND -m state --state RELATED,ESTABLISHED -j ACCEPT
   -A FW_OUTBOUND -j FW_EGRESS_RULES
   ```
   
   
   - affer adding a rule to allow port 22 and 1.2.3.4/32
   
   ```
   root@r-628-VM:~# iptables-save |grep FW_
   -A FORWARD -i eth0 -o eth2 -j FW_OUTBOUND
   -A FW_EGRESS_RULES -p tcp -m set --match-set destCidrIpset-971 dst -m tcp 
--dport 22 -j ACCEPT
   -A FW_EGRESS_RULES -j DROP
   -A FW_OUTBOUND -m state --state RELATED,ESTABLISHED -j ACCEPT
   -A FW_OUTBOUND -j FW_EGRESS_RULES
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to