Re: [openstack-dev] [Openstack][Neutron]Why we use secuirity group which only support dispatching whiltelist rules?

2017-04-28 Thread Akihiro Motoki
2017-04-28 7:03 GMT+09:00 Monty Taylor : > On 04/25/2017 10:32 AM, Gary Kotton wrote: >> >> Hi, >> I would like us to think of considering enabling an API that would allow >> ‘deny’, for example an admin could overwrite a tenant’s security groups. For >> example, and admin may not want a specific s

Re: [openstack-dev] [Openstack][Neutron]Why we use secuirity group which only support dispatching whiltelist rules?

2017-04-27 Thread Monty Taylor
On 04/25/2017 10:32 AM, Gary Kotton wrote: Hi, I would like us to think of considering enabling an API that would allow ‘deny’, for example an admin could overwrite a tenant’s security groups. For example, and admin may not want a specific source range to access the tenants VM’s. The guys work

Re: [openstack-dev] [Openstack][Neutron]Why we use secuirity group which only support dispatching whiltelist rules?

2017-04-25 Thread Gary Kotton
Hi, I would like us to think of considering enabling an API that would allow ‘deny’, for example an admin could overwrite a tenant’s security groups. For example, and admin may not want a specific source range to access the tenants VM’s. The guys working on FWaaS say that this may happen in V2,

Re: [openstack-dev] [Openstack][Neutron]Why we use secuirity group which only support dispatching whiltelist rules?

2017-04-23 Thread Ihar Hrachyshka
All traffic is denied by default. OpenStack security groups API is modeled to reflect what AWS does. You may find your needs better served by fwaas plugin for neutron that is not constrained by AWS compatibility. Ihar On Sun, Apr 23, 2017 at 8:33 PM, 田明明 wrote: > Can we add an "action" to securi

[openstack-dev] [Openstack][Neutron]Why we use secuirity group which only support dispatching whiltelist rules?

2017-04-23 Thread 田明明
Can we add an "action" to security group rule api, so that we could dispatch rules with "deny" action? Until now, security group only supports add white-list rules but this couldn't satisfy many people's needs. ___