Apply firewall policies to router ports

Create firewall groups to attach policies to router ports.

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

Procedure
Copy link

  1. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh openstackclient
  2. Create the firewall group:
    Example

    In this example, a firewall group, my-fw-group, associates the ingress firewall policy, my-policy, to the router port, 1234:

    $ openstack firewall group create --ingress-firewall-policy my-policy --port 1234 --name my-fw-group

    A successful command produces output similar to the following:

    +-------------------+------------------------------------------+
| Field             | Value                                    |
+-------------------+------------------------------------------+
| Description       |                                          |
| Egress Policy ID  | None                                     |
| ID                | 71f13cd2-a6a9-449d-8c76-3afc576a619b     |
| Ingress Policy ID | 55063d58-73b6-4366-9cc9-461a69dbe61f     |
| Name              | my-fw-group                              |
| Ports             | ['8c6812eb-b8b4-492d-b275-10ecbda21901'] |
| Project           | 3302eebb4fba4b06bd30724463e37ba2         |
| Shared            | False                                    |
| State             | UP                                       |
| Status            | ACTIVE                                   |
| created_at        | 2026-05-26T16:53:18Z                     |
| project_id        | 3302eebb4fba4b06bd30724463e37ba2         |
| revision_number   | 0                                        |
| tags              | []                                       |
| updated_at        | 2026-05-26T16:53:18Z                     |
+-------------------+------------------------------------------+
  3. Exit the openstackclient pod: 
    $ exit

Apply a firewall group to a router port (example)
Copy link

Apply a firewall group to a router port in Red Hat OpenStack Services on OpenShift (RHOSO).

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.
  • You have created an ingress or egress firewall policy.
  • You have a router connecting a private and external network.

Procedure
Copy link

  1. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh openstackclient
  2. Retrieve the internal port ID of the router: 
    $ openstack port list --router <router-name> --network <private-network-name>

    The command output resembles the following:

    +--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
| ID                                   | Name | MAC Address       | Fixed IP Addresses                                                         | Status |
+--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
| 8c6812eb-b8b4-492d-b275-10ecbda21901 |      | fa:16:3e:b3:eb:95 | ip_address='192.168.1.1', subnet_id='ab31dc3d-cc67-4288-a1c3-c2eb65f9a184' | ACTIVE |
+--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
  3. Create the firewall group and apply it to the port using the ID retrieved in the previous step: 
    $ openstack firewall group create --ingress-firewall-policy <policy-name> --port <router-port-id> --name <fw-group-name>

    Where:

    • <policy_name>: Specifies the name of your firewall policy.
    • <router_port_id>: Specifies the router port ID retrieved in the previous step.
    • <fw_group_name>: Specifies the name you want to assign to this firewall group.

      The command output resembles the following:

      +-------------------+------------------------------------------+
| Field             | Value                                    |
+-------------------+------------------------------------------+
| Description       |                                          |
| Egress Policy ID  | None                                     |
| ID                | 71f13cd2-a6a9-449d-8c76-3afc576a619b     |
| Ingress Policy ID | 55063d58-73b6-4366-9cc9-461a69dbe61f     |
| Name              | my-fw-group                              |
| Ports             | ['8c6812eb-b8b4-492d-b275-10ecbda21901'] |
| Project           | 3302eebb4fba4b06bd30724463e37ba2         |
| Shared            | False                                    |
| State             | UP                                       |
| Status            | ACTIVE                                   |
| created_at        | 2026-05-26T16:53:18Z                     |
| project_id        | 3302eebb4fba4b06bd30724463e37ba2         |
| revision_number   | 0                                        |
| tags              | []                                       |
| updated_at        | 2026-05-26T16:53:18Z                     |
+-------------------+------------------------------------------+
  4. Exit the openstackclient pod: 
    $ exit

Control ICMP traffic with FWaaS and security groups (example)
Copy link

Control ICMP traffic by using Firewall as a Service and security groups.

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.
  • An external provider network (for example, public) is available to act as an external gateway and provide floating IPs.
  • An image and flavor are available for instance creation.

About this task
Copy link

This example procedure demonstrates the layered defense strategy of using Firewall as a Service (FWaaS) for north-south perimeter control alongside standard security groups for east-west micro-segmentation.

In this scenario, you create a tenant network with two instances, VM A and VM B. By default, the instances are assigned to the default security group, which permits all traffic between instances in the same group. You then apply a firewall group to the router port to explicitly allow incoming ICMP (ping) traffic to VM A while denying ICMP traffic to VM B.

Procedure
Copy link

  1. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh openstackclient
  2. Create the tenant network: 
    $ openstack network create tenant-net

    Sample output:

    +---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2026-05-26T16:42:03Z                 |
| description               |                                      |
| dns_domain                |                                      |
| id                        | 6c6ad6a8-68a1-4289-bd0e-68140434e7d1 |
| ipv4_address_scope        | None                                 |
| ipv6_address_scope        | None                                 |
| is_default                | False                                |
| is_vlan_transparent       | None                                 |
| l2_adjacency              | True                                 |
| mtu                       | 1442                                 |
| name                      | tenant-net                           |
| port_security_enabled     | True                                 |
| project_id                | 3302eebb4fba4b06bd30724463e37ba2     |
| provider:network_type     | geneve                               |
| provider:physical_network | None                                 |
| provider:segmentation_id  | 58760                                |
| qos_policy_id             | None                                 |
| revision_number           | 1                                    |
| router:external           | Internal                             |
| segments                  | None                                 |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tags                      |                                      |
| tenant_id                 | 3302eebb4fba4b06bd30724463e37ba2     |
| updated_at                | 2026-05-26T16:42:04Z                 |
+---------------------------+--------------------------------------+
  3. Create the subnet: 
    $ openstack subnet create --network tenant-net --subnet-range 192.168.1.0/24 tenant-subnet

    Sample output:

    +----------------------+--------------------------------------+
| Field                | Value                                |
+----------------------+--------------------------------------+
| allocation_pools     | 192.168.1.2-192.168.1.254            |
| cidr                 | 192.168.1.0/24                       |
| created_at           | 2026-05-26T16:46:58Z                 |
| description          |                                      |
| dns_nameservers      |                                      |
| dns_publish_fixed_ip | None                                 |
| enable_dhcp          | True                                 |
| gateway_ip           | 192.168.1.1                          |
| host_routes          |                                      |
| id                   | ab31dc3d-cc67-4288-a1c3-c2eb65f9a184 |
| ip_version           | 4                                    |
| ipv6_address_mode    | None                                 |
| ipv6_ra_mode         | None                                 |
| name                 | tenant-subnet                        |
| network_id           | 6c6ad6a8-68a1-4289-bd0e-68140434e7d1 |
| project_id           | 3302eebb4fba4b06bd30724463e37ba2     |
| revision_number      | 0                                    |
| segment_id           | None                                 |
| service_types        |                                      |
| subnetpool_id        | None                                 |
| tags                 |                                      |
| updated_at           | 2026-05-26T16:46:58Z                 |
+----------------------+--------------------------------------+
  4. Create a router: 
    $ openstack router create tenant-router

    Sample output:

    +-------------------------+--------------------------------------+
| Field                   | Value                                |
+-------------------------+--------------------------------------+
| admin_state_up          | UP                                   |
| availability_zone_hints |                                      |
| availability_zones      |                                      |
| created_at              | 2026-05-26T16:49:24Z                 |
| description             |                                      |
| enable_ndp_proxy        | None                                 |
| external_gateway_info   | null                                 |
| flavor_id               | None                                 |
| ha                      | True                                 |
| id                      | d66c003e-2654-496a-90b7-f6ae0e7d207a |
| name                    | tenant-router                        |
| project_id              | 3302eebb4fba4b06bd30724463e37ba2     |
| revision_number         | 1                                    |
| routes                  |                                      |
| status                  | ACTIVE                               |
| tags                    |                                      |
| tenant_id               | 3302eebb4fba4b06bd30724463e37ba2     |
| updated_at              | 2026-05-26T16:49:24Z                 |
+-------------------------+--------------------------------------+
  5. Connect the router to your tenant subnet: 
    $ openstack router add subnet tenant-router tenant-subnet
  6. Set the external gateway: 
    $ openstack router set --external-gateway public tenant-router
  7. Create two instances connected to the tenant network. Because no security group is specified, they automatically use the default security group: 
    $ openstack server create --flavor <flavor> --image <image> --network tenant-net vma
$ openstack server create --flavor <flavor> --image <image> --network tenant-net vmb
  8. Create or identify two floating IP addresses on your external network: 
    $ openstack floating ip create public
$ openstack floating ip create public
$ openstack floating ip list

    Floating IP address lists resemble the following example:

    +--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+
| ID                                   | Floating IP Address | Fixed IP Address | Port | Floating Network                     | Project                          |
+--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+
| 45071ba0-2e6b-4f56-8642-93058db50c42 | 172.38.0.103        | None             | None | ae9b08ec-f962-403e-828d-bab06d8b9b40 | 3302eebb4fba4b06bd30724463e37ba2 |
| f6cee4de-e1d6-4681-beb3-6b2a9d9177ce | 172.38.0.116        | None             | None | ae9b08ec-f962-403e-828d-bab06d8b9b40 | 3302eebb4fba4b06bd30724463e37ba2 |
+--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+
  9. Assign the floating IP addresses to the instances: 
    $ openstack server add floating ip vma 45071ba0-2e6b-4f56-8642-93058db50c42
$ openstack server add floating ip vmb f6cee4de-e1d6-4681-beb3-6b2a9d9177ce
  10. Verify the floating IP address assignments: 
    $ openstack floating ip list

    A successful verification resembles the following example:

    +--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
| ID                                   | Floating IP Address | Fixed IP Address | Port                                 | Floating Network                     | Project                          |
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
| 45071ba0-2e6b-4f56-8642-93058db50c42 | 172.38.0.103        | 192.168.1.179    | 88db74c8-1ee3-48fa-8049-3e7b201b7037 | ae9b08ec-f962-403e-828d-bab06d8b9b40 | 3302eebb4fba4b06bd30724463e37ba2 |
| f6cee4de-e1d6-4681-beb3-6b2a9d9177ce | 172.38.0.116        | 192.168.1.107    | e72460a9-c1f6-4ba3-a069-9f0ee20048c4 | ae9b08ec-f962-403e-828d-bab06d8b9b40 | 3302eebb4fba4b06bd30724463e37ba2 |
+--------------------------------------+---------------------+------------------+--------------------------------------+--------------------------------------+----------------------------------+
  11. Identify the internal port ID of the router that connects to your tenant network. You will apply the firewall group to this port: 
    $ openstack port list --router tenant-router --network tenant-net

    The command output resembles the following example:

    +--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
| ID                                   | Name | MAC Address       | Fixed IP Addresses                                                         | Status |
+--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
| 8c6812eb-b8b4-492d-b275-10ecbda21901 |      | fa:16:3e:b3:eb:95 | ip_address='192.168.1.1', subnet_id='ab31dc3d-cc67-4288-a1c3-c2eb65f9a184' | ACTIVE |
+--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
  12. Create firewall group rules. Create a permissive rule allowing ICMP traffic to the fixed IP address for VM A, and a restrictive rule denying all other ICMP traffic.
    1. Identify the servers: 
      $ openstack server list --all

      A server list resembles the following example:

      +--------------------------------------+-------------------------------+--------+--------------------------------------------------------------+-------------------------------+-------------------------------+
| ID                                   | Name                          | Status | Networks                                                     | Image                         | Flavor                        |
+--------------------------------------+-------------------------------+--------+--------------------------------------------------------------+-------------------------------+-------------------------------+
| fca9d0ac-cbf8-4e78-a244-c51acea02f16 | vmb                           | ACTIVE | tenant-net=172.38.0.116, 192.168.1.107                       | custom_neutron_guest_rhel_8.4 | custom_neutron_guest_rhel_8.4 |
| 968845c0-270e-49f3-a5b2-b1a6a323bbc6 | vma                           | ACTIVE | tenant-net=172.38.0.103, 192.168.1.179                       | custom_neutron_guest_rhel_8.4 | custom_neutron_guest_rhel_8.4 |
+--------------------------------------+-------------------------------+--------+--------------------------------------------------------------+-------------------------------+-------------------------------+
    2. Create the permissive rule: 
      $ openstack firewall group rule create --protocol icmp --destination-ip-address 192.168.1.179 --action allow --name allow-icmp-vma
      Note

      Use the fixed IP address of the VM instance when specifying source-ip-address and --destination-ip-address, not the floating IP address. Rules are applied on the internal port of the router, after network address translation (NAT).

      Sample output:

      +------------------------+--------------------------------------+
| Field                  | Value                                |
+------------------------+--------------------------------------+
| Action                 | allow                                |
| Description            |                                      |
| Destination IP Address | 192.168.1.179                        |
| Destination Port       | None                                 |
| Enabled                | True                                 |
| ID                     | 8f45bcfe-f1b4-4da6-b061-6ef466245e2c |
| IP Version             | 4                                    |
| Name                   | allow-icmp-vma                       |
| Project                | 3302eebb4fba4b06bd30724463e37ba2     |
| Protocol               | icmp                                 |
| Shared                 | False                                |
| Source IP Address      | None                                 |
| Source Port            | None                                 |
| created_at             | 2026-05-26T17:12:48Z                 |
| firewall_policy_id     | None                                 |
| project_id             | 3302eebb4fba4b06bd30724463e37ba2     |
| revision_number        | 0                                    |
| tags                   | []                                   |
| updated_at             | 2026-05-26T17:12:48Z                 |
+------------------------+--------------------------------------+
    3. Create the deny rule: 
      $ openstack firewall group rule create --protocol icmp --action deny --name deny-icmp

      Sample output:

      +------------------------+--------------------------------------+
| Field                  | Value                                |
+------------------------+--------------------------------------+
| Action                 | deny                                 |
| Description            |                                      |
| Destination IP Address | None                                 |
| Destination Port       | None                                 |
| Enabled                | True                                 |
| ID                     | d2f13bb9-d0ca-4e7b-ac70-cb25d8755625 |
| IP Version             | 4                                    |
| Name                   | deny-icmp                            |
| Project                | 3302eebb4fba4b06bd30724463e37ba2     |
| Protocol               | icmp                                 |
| Shared                 | False                                |
| Source IP Address      | None                                 |
| Source Port            | None                                 |
| created_at             | 2026-05-26T17:24:08Z                 |
| firewall_policy_id     | None                                 |
| project_id             | 3302eebb4fba4b06bd30724463e37ba2     |
| revision_number        | 0                                    |
| tags                   | []                                   |
| updated_at             | 2026-05-26T17:24:08Z                 |
+------------------------+--------------------------------------+
  13. Create a firewall group policy and add the rules.
    Important
    Rule order is critical in FWaaS. Ensure you add the permissive rule before the restrictive rule so that traffic to VM A is evaluated and allowed before the deny rule drops the rest: 
    $ openstack firewall group policy create --firewall-rule 8f45bcfe-f1b4-4da6-b061-6ef466245e2c --firewall-rule d2f13bb9-d0ca-4e7b-ac70-cb25d8755625 fwaas-icmp-policy

    Sample output:

    +-----------------+----------------------------------------------------------------------------------+
| Field           | Value                                                                            |
+-----------------+----------------------------------------------------------------------------------+
| Audited         | False                                                                            |
| Description     |                                                                                  |
| Firewall Rules  | ['8f45bcfe-f1b4-4da6-b061-6ef466245e2c', 'd2f13bb9-d0ca-4e7b-ac70-cb25d8755625'] |
| ID              | f258b6cb-0302-4ac4-be36-7f5dc966d8a0                                             |
| Name            | fwaas-icmp-policy                                                                |
| Project         | 3302eebb4fba4b06bd30724463e37ba2                                                 |
| Shared          | False                                                                            |
| created_at      | 2026-05-26T17:27:45Z                                                             |
| project_id      | 3302eebb4fba4b06bd30724463e37ba2                                                 |
| revision_number | 0                                                                                |
| tags            | []                                                                               |
| updated_at      | 2026-05-26T17:27:45Z                                                             |
+-----------------+----------------------------------------------------------------------------------+
  14. Create the firewall group, attach the policy for ingress and egress traffic, and apply it to the router port: 
    $ openstack firewall group create --ingress-firewall-policy fwaas-icmp-policy --egress-firewall-policy fwaas-icmp-policy --port 8c6812eb-b8b4-492d-b275-10ecbda21901 --name tenant-fw-group

    Sample output:

    +-------------------+------------------------------------------+
| Field             | Value                                    |
+-------------------+------------------------------------------+
| Description       |                                          |
| Egress Policy ID  | f258b6cb-0302-4ac4-be36-7f5dc966d8a0     |
| ID                | b242b181-d62c-41b5-b4ba-cb94ee8f8f94     |
| Ingress Policy ID | f258b6cb-0302-4ac4-be36-7f5dc966d8a0     |
| Name              | tenant-fw-group                          |
| Ports             | ['8c6812eb-b8b4-492d-b275-10ecbda21901'] |
| Project           | 3302eebb4fba4b06bd30724463e37ba2         |
| Shared            | False                                    |
| State             | UP                                       |
| Status            | ACTIVE                                   |
| created_at        | 2026-05-26T17:31:12Z                     |
| project_id        | 3302eebb4fba4b06bd30724463e37ba2         |
| revision_number   | 0                                        |
| tags              | []                                       |
| updated_at        | 2026-05-26T17:31:12Z                     |
+-------------------+------------------------------------------+
  15. Add a security group rule that allows ICMP, so that ICMP traffic can reach floating IP addresses: 
    $ openstack security group rule create --protocol icmp <security-group-id>
  16. Exit the openstackclient pod: 
    $ exit

Test ICMP control firewall and security group rules (example)
Copy link

After you configure firewall and security group rules to control ping access, you can run ping to validate the configuration.

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

Procedure
Copy link

  1. Identify the servers: 
    $ openstack server list --all

    A server list resembles the following example:

    +--------------------------------------+-------------------------------+--------+--------------------------------------------------------------+-------------------------------+-------------------------------+
| ID                                   | Name                          | Status | Networks                                                     | Image                         | Flavor                        |
+--------------------------------------+-------------------------------+--------+--------------------------------------------------------------+-------------------------------+-------------------------------+
| fca9d0ac-cbf8-4e78-a244-c51acea02f16 | vmb                           | ACTIVE | tenant-net=172.38.0.116, 192.168.1.107                       | custom_neutron_guest_rhel_8.4 | custom_neutron_guest_rhel_8.4 |
| 968845c0-270e-49f3-a5b2-b1a6a323bbc6 | vma                           | ACTIVE | tenant-net=172.38.0.103, 192.168.1.179                       | custom_neutron_guest_rhel_8.4 | custom_neutron_guest_rhel_8.4 |
+--------------------------------------+-------------------------------+--------+--------------------------------------------------------------+-------------------------------+-------------------------------+
  2. From an external network (such as your workstation), ping the floating IP address (FIP) of VM A. The ping succeeds because the FWaaS policy on the router port explicitly allows ICMP traffic destined for VM A: 
    $ ping -c4 172.38.0.103

    The IMCP connection succeeds as demonstrated in the following example:

    PING 172.38.0.103 (172.38.0.103) 56(84) bytes of data.
64 bytes from 172.38.0.103: icmp_seq=1 ttl=63 time=3.17 ms
64 bytes from 172.38.0.103: icmp_seq=2 ttl=63 time=1.39 ms
64 bytes from 172.38.0.103: icmp_seq=3 ttl=63 time=0.899 ms
64 bytes from 172.38.0.103: icmp_seq=4 ttl=63 time=0.641 ms

--- 172.38.0.103 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
  3. From the external network, attempt to ping the floating IP of VM B. The ping fails because the traffic does not match the first FWaaS rule and is subsequently dropped by the deny rule on the router: 
    $ ping -c4 172.38.0.116

    The IMCP connection fails as demonstrated in the following example:

    PING 172.38.0.116 (172.38.0.116) 56(84) bytes of data.

--- 172.38.0.116 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3096ms
  4. Log in to VM A (for example, using the console or SSH) and ping the fixed IP of VM B. The ping succeeds without issue. Because this traffic remains within the tenant-net layer 2 broadcast domain (east-west traffic), it does not pass through the router and is therefore not evaluated by the FWaaS rules. The default security group correctly permits the traffic between the two instances: 
    [root@vma ~]# ping 192.168.1.107

    The ICMP connection succeeds as demonstrated in the following example:

    PING 192.168.1.107 (192.168.1.107) 56(84) bytes of data.
64 bytes from 192.168.1.107: icmp_seq=1 ttl=64 time=3.27 ms
64 bytes from 192.168.1.107: icmp_seq=2 ttl=64 time=2.07 ms
64 bytes from 192.168.1.107: icmp_seq=3 ttl=64 time=1.14 ms

Order firewall group rules correctly (example)
Copy link

Order firewall group rules for sequential traffic evaluation.

Before you begin
Copy link

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

Procedure
Copy link

  1. Access the remote shell for the OpenStackClient pod from your workstation: 
    $ oc rsh openstackclient
  2. Create a permissive rule that allows all ICMP traffic: 
    $ openstack firewall group rule create --name testrule1 --protocol icmp --action allow
  3. Create a restrictive rule that denies ICMP traffic from a specific IP address: 
    $ openstack firewall group rule create --name testrule2 --protocol icmp --source-ip-address <vm2-ip> --action deny
    Note

    Use the fixed IP address of the VM instance when specifying source-ip-address and --destination-ip-address, not the floating IP address. Rules are applied on the internal port of the router, after network address translation (NAT).
  4. Create a firewall group policy where the permissive rule is placed before the restrictive rule: 
    $ openstack firewall group policy create --firewall-rule <allow-all-rule-id> --firewall-rule <deny-specific-rule-id> my-ordered-policy
    Important

    Because rules are evaluated from top to bottom, the traffic from the specific IP address will be permitted. The traffic matches the general allow rule first, and the firewall permits it before ever processing the deny rule below it.
  5. Exit the openstackclient pod: 
    $ exit