andrijapanicsb commented on PR #13684: URL: https://github.com/apache/cloudstack/pull/13684#issuecomment-5388856170
> > @weizhouapache thing that there is a misunderstanding here: from what I know (worth testing....) the default DENY rule applies only until someone adds a very first egress rule (any) - after that - if they want to allow just some outgoing/egress traffic and notall, there is no more "default/failback" DENY rule exising, it has to be explicitly added. > > afaik, if egress policy is DENY, the REJECT rule is always the last rule in the iptables chain, the other rules in the chain are ACCEPT-ed. Similarly, if egress policy is ALLOW, the ACCEPT rule is the last while other rules are REJECT-ed. I will test tomorrow. That is the point - as an operator/firewall admin - you absolutely want to explicitly control your ACL and not rely on some smart/stupid hardcoded rule that defaults to this or that. but it's very good your tested this @weizhouapache , thx a lot!, so the default rule is still kept, no matter new ACCEPT rules are added.... For ACLs in VPC - there is no such stuff - you make new ACL - accept/allow what you want, and final catch-all DENY/REJECT rule - for years - and this is how it's propertly done. Do you agree on my thinking/logic or have remarks @weizhouapache ? 🙇♂️ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
