Chapter 18. Configuring Firewall-as-a-Service (FWaaS)

download PDF

18.1. Overview of firewall-as-a-service (FWaaS)

The Firewall-as-a-Service (FWaaS) plug-in adds perimeter firewall management to OpenStack Networking (neutron). FWaaS uses iptables to apply firewall policy to all virtual routers within a project, and supports one firewall policy and logical firewall instance for each project.

FWaaS operates at the perimeter by filtering traffic at the OpenStack Networking (neutron) router. This distinguishes FWaaS from security groups, which operate at the instance level.


FWaaS is currently in Technology Preview; untested operation is not recommended. FWaaS is not available in future releases.

The following example diagram illustrates the flow of ingress and egress traffic for the VM2 instance:


Figure 1. FWaaS architecture

18.2. Enabling firewall-as-a-service (FWaaS)

  1. Install the FWaaS packages:

    # dnf install openstack-neutron-fwaas python-neutron-fwaas
  2. Enable the FWaaS plugin in the /var/lib/config-data/neutron/etc/neutron/neutron.conf file:

    service_plugins =
  3. Configure FWaaS in the fwaas_driver.ini file:

    driver =
    enabled = True
    service_provider =
  4. Enable the FWaaS dashboard management option in the file, usually located on the Controller node:

    'enable_firewall' = True
  5. Restart neutron-server to apply the changes.

    # systemctl restart neutron-server

18.3. Configuring firewall-as-a-service (FWaaS)

First, create the firewall rules and create a policy to contain them, then create a firewall and apply the policy:

  1. Create a firewall rule:

    $ neutron firewall-rule-create --protocol <tcp|udp|icmp|any> --destination-port <port-range> --action <allow|deny>

    The CLI requires a protocol value. If the rule is protocol agnostic, you can use the value any.

  2. Create a firewall policy:

    $ neutron firewall-policy-create --firewall-rules "<firewall-rule IDs or names separated by space>" myfirewallpolicy

    The order of the rules that you specify in the neutron firewall-policy-create command is important. You can create an empty firewall policy and add rules later, either with the update operation (when adding multiple rules) or with the insert-rule operations (when adding a single rule).


FWaaS always adds a default deny all rule at the lowest precedence of each policy. Consequently, a firewall policy with no rules blocks all traffic by default.

18.4. Creating firewalls

  • Use the openstack security group create command, to create a firewall:

    $ openstack security group create <firewall-policy-uuid>

The firewall remains in PENDING_CREATE state until you create an OpenStack Networking router and attach an interface.

Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.