You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by ah...@apache.org on 2012/10/05 00:39:12 UTC
[2/2] git commit: CS-16049 : VPC,
VR provides metadata and user data through port 80,
this port should be only open for targeting to this VR ip
CS-16049 : VPC, VR provides metadata and user data through port 80, this port should be only open for targeting to this VR ip
Project: http://git-wip-us.apache.org/repos/asf/incubator-cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-cloudstack/commit/4cb4628b
Tree: http://git-wip-us.apache.org/repos/asf/incubator-cloudstack/tree/4cb4628b
Diff: http://git-wip-us.apache.org/repos/asf/incubator-cloudstack/diff/4cb4628b
Branch: refs/heads/4.0
Commit: 4cb4628bec80e17f8bdec256f0e64f839412261c
Parents: 0c6bdd2
Author: Anthony Xu <an...@cloud.com>
Authored: Thu Sep 27 14:28:06 2012 -0700
Committer: Alex Huang <al...@citrix.com>
Committed: Thu Oct 4 15:38:26 2012 -0700
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/vpc_guestnw.sh | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-cloudstack/blob/4cb4628b/patches/systemvm/debian/config/opt/cloud/bin/vpc_guestnw.sh
----------------------------------------------------------------------
diff --git a/patches/systemvm/debian/config/opt/cloud/bin/vpc_guestnw.sh b/patches/systemvm/debian/config/opt/cloud/bin/vpc_guestnw.sh
index faf62c6..e5845fa 100755
--- a/patches/systemvm/debian/config/opt/cloud/bin/vpc_guestnw.sh
+++ b/patches/systemvm/debian/config/opt/cloud/bin/vpc_guestnw.sh
@@ -132,6 +132,11 @@ create_guest_network() {
sudo ip addr add dev $dev $ip/$mask brd +
sudo ip link set $dev up
sudo arping -c 3 -I $dev -A -U -s $ip $ip
+ # setup rules to allow dhcp/dns request
+ sudo iptables -D INPUT -i $dev -d $ip -p udp -m udp --dport 67 -j ACCEPT
+ sudo iptables -D INPUT -i $dev -d $ip -p udp -m udp --dport 53 -j ACCEPT
+ sudo iptables -A INPUT -i $dev -d $ip -p udp -m udp --dport 67 -j ACCEPT
+ sudo iptables -A INPUT -i $dev -d $ip -p udp -m udp --dport 53 -j ACCEPT
# restore mark from connection mark
local tableName="Table_$dev"
sudo ip route add $subnet/$mask dev $dev table $tableName proto static
@@ -150,6 +155,8 @@ destroy_guest_network() {
logger -t cloud " $(basename $0): Create network on interface $dev, gateway $gw, network $ip/$mask "
sudo ip addr del dev $dev $ip/$mask
+ sudo iptables -D INPUT -i $dev -d $ip -p udp -m udp --dport 67 -j ACCEPT
+ sudo iptables -D INPUT -i $dev -d $ip -p udp -m udp --dport 53 -j ACCEPT
sudo iptables -t mangle -D PREROUTING -i $dev -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
sudo iptables -t nat -D POSTROUTING -s $subnet/$mask -o $dev -j SNAT --to-source $ip
destroy_acl_chain