[I] VMs with security groups allowing all egress traffic cannot access the Internet in 4.23.0.0 [cloudstack]

["weizhouapache (via GitHub)" <gi...@apache.org>]

weizhouapache opened a new issue, #14099:
URL: https://github.com/apache/cloudstack/issues/14099

   ### problem
   
   # Description
   
   In CloudStack 4.23.0.0, a VM cannot access the Internet when its security group has egress rules configured, even when the egress rules allow all outbound traffic (0.0.0.0/0).
   
   The same configuration works as expected in older CloudStack versions.
   
   The issue occurs when the security group has egress rules but no ingress rules.
   
   
   # Expected behavior
   
   The VM should be able to initiate outbound connections to the Internet when the security group has an egress rule allowing all traffic.
   
   According to the CloudStack documentation:
   ```
   If there is no Egress rule in a Security Group, all the outgoing traffic will be allowed.
   If there are Egress rules in a Security Group, only the outgoing traffic which match a Egress rule will be allowed.
   Only the incoming traffic which match a Ingress rule will be allowed.
   ```
   
   # Actual behavior
   
   With CloudStack 4.23.0.0:
   
   - The VM has a security group assigned.
   - The security group has one egress rule allowing ALL outbound traffic.
   - There are no ingress rules.
   - The VM cannot access the Internet.
   
   <img width="2278" height="724" alt="Image" src="https://github.com/user-attachments/assets/068810d1-f2d1-4965-84eb-2195467755af" />
   
   
   <img width="1242" height="198" alt="Image" src="https://github.com/user-attachments/assets/4370a717-c4cd-4079-8625-7f06c2bcc6a9" />
   
   
   ### versions
   
   The versions of ACS, hypervisors, storage, network etc..
   
   ### The steps to reproduce the bug
   
   1.
   2.
   3.
   ...
   
   
   ### What to do about it?
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] VMs with security groups allowing all egress traffic cannot access the Internet in 4.23.0.0 [cloudstack]

["nvazquez (via GitHub)" <gi...@apache.org>]

nvazquez closed issue #14099: VMs with security groups allowing all egress traffic cannot access the Internet in 4.23.0.0
URL: https://github.com/apache/cloudstack/issues/14099


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org