Re: VPC and Egress Rules: is it broken?

2020-10-13 Thread rvalle
lated virtual router and checked if the > declared firewall rules are visible? > > With regards > Thomas Joseph > > On Tue, 13 Oct 2020, 10:53 am Rafael del Valle, " > target="_blank"> > wrote: > > > arrrgh... > > > > Not even the 999

Re: VPC and Egress Rules: is it broken?

2020-10-13 Thread Thomas Joseph
Have you logged on to the related virtual router and checked if the declared firewall rules are visible? With regards Thomas Joseph On Tue, 13 Oct 2020, 10:53 am Rafael del Valle, wrote: > arrrgh... > > Not even the rule helps once I deploy all my tiers and rules. > > Eg

Re: VPC and Egress Rules: is it broken?

2020-10-13 Thread Rafael del Valle
arrrgh... Not even the rule helps once I deploy all my tiers and rules. Egress just seems broken on VPC in 4.14. Anybody successfully using Egress/VPC in 4.14? On Tue, 2020-10-13 09:37 AM, rva...@privaz.io.INVALID wrote: > Hi Rene, > > I know what you mean now: the "B

Re: VPC and Egress Rules: is it broken?

2020-10-13 Thread rvalle
Hi Rene, I know what you mean now: the "By default, all incoming traffic to the guest networks is blocked and all outgoing traffic from guest networks is allowed, once you add an ACL rule for outgoing traffic, then only outgoing traffic specified in this ACL rule is allowed, the rest is blocked."

Re: VPC and Egress Rules: is it broken?

2020-10-12 Thread rvalle
Yes, I also found that confusing. So, I decided to create one ACL per tier, with the same name as the tier. Since my rules are created by (the fantastic ;) ansible modules... I can have as many as I want, pretty fine grained. I have checked that the ACLs and tiers are (still) assigned

Re: VPC and Egress Rules: is it broken?

2020-10-12 Thread Rene Moser
On 12.10.20 17:30, rva...@privaz.io.INVALID wrote: Am I missing something? It's been a while but I remember the default egress rule is "allow from all". https://docs.cloudstack.apache.org/en/4.14.0.0/adminguide/networking/virtual_private_cloud_config.html?#about-network-acl-lists The doc

VPC and Egress Rules: is it broken?

2020-10-12 Thread rvalle
Hi! I have created a "backend" tier, where sensitive data will be stored. I just noticed that VMs in this tier can access the internet (SourceNat, Port 80/443 to World) despite no Egress rule that allows it. According to the documentation "The CIDR acts as the Destination CIDR for the Egress