How works Security Groups?

asked 2016-05-18 09:48:45 -0500

David17
3 ●1 ●1 ●3

Hi,

I would like to know how really works the security groups, What is the mechanism to pass the rules to the machines? It use a orchestation tool? Where I can find this information?

Thanks!!

edit retag flag offensive close merge delete

add a comment

1

answered 2016-05-19 10:34:12 -0500

rmelton
26 ●1 ●1 ●4

updated 2016-05-19 11:19:28 -0500

Security Group rules are enforced by Linux iptable rules at the compute host level. I'm using DVR (dist virtual routing) on Kilo, here are some rules dumped out on a compute host:

sudo iptables -L

Chain neutron-openvswi-i76b78cbd-2 (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere             state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */
RETURN     udp  --  192.168.51.2         anywhere             udp spt:bootps dpt:bootpc
RETURN     tcp  --  anywhere             anywhere             tcp
RETURN     udp  --  anywhere             anywhere             udp
RETURN     icmp --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */
neutron-openvswi-sg-fallback  all  --  anywhere             anywhere             /* Send unmatched traffic to the fallback chain. */

yes, you can create security group rules in Heat orchestration template. Here is a brief example:

 mysecurity_group:
    type: OS::Neutron::SecurityGroup
    properties:
      description: Neutron security group rules
      name: mysecurity_group
      rules:
      - remote_ip_prefix: 0.0.0.0/0
        protocol: tcp
        port_range_min: 0
        port_range_max: 65535
        direction: ingress

edit flag offensive delete link

Comments

I'm new to the whole OpenStack networking but this article (1) suggests they're implemented on virtual switch instead of on the hosts themselves. I tried finding more info about that but couldn't.

1) https://www.stratoscale.com/blog/openstack/openstack-security-groups-best-practices/ (https://www.stratoscale.com/blog/open...)