Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 19. Configure Firewall-as-a-Service (FWaaS)

The Firewall-as-a-Service (FWaaS) plug-in adds perimeter firewall management to OpenStack Networking (neutron). FWaaS uses iptables to apply firewall policy to all virtual routers within a project, and supports one firewall policy and logical firewall instance per project.

FWaaS operates at the perimeter by filtering traffic at the OpenStack Networking (neutron) router. This distinguishes it from security groups, which operate at the instance level.

Note

FWaaS is currently in technical preview; untested operation is not recommended.

The example diagram below illustrates the flow of ingress and egress traffic for the VM2 instance:

fwaas
View larger image
fwaas

Figure 1. FWaaS architecture

19.1. Enable FWaaS
Copiar enlace

1. Install the FWaaS packages: 

# yum install openstack-neutron-fwaas python-neutron-fwaas
Copy to Clipboard Toggle word wrap

2. Enable the FWaaS plugin in the neutron.conf file: 

service_plugins = neutron.services.firewall.fwaas_plugin.FirewallPlugin
Copy to Clipboard Toggle word wrap

3. Configure FWaaS in the fwaas_driver.ini file: 

[fwaas]
driver = neutron.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriver
enabled = True

[service_providers]
service_provider = LOADBALANCER:Haproxy:neutron_lbaas.services.loadbalancer.drivers.haproxy.plugin_driver.HaproxyOnHostPluginDriver:default
Copy to Clipboard Toggle word wrap

4. FWaaS management options are available in OpenStack dashboard. Enable this option in the local_settings.py file, usually located on the Controller node: 

/usr/share/openstack-dashboard/openstack_dashboard/local/local_settings.py
'enable_firewall' = True
Copy to Clipboard Toggle word wrap

5. Restart neutron-server to apply the changes. 

# systemctl restart neutron-server
Copy to Clipboard Toggle word wrap

19.2. Configure FWaaS
Copiar enlace

First create the firewall rules and create a policy to contain them, then create a firewall and apply the policy:

1. Create a firewall rule: 

$ neutron firewall-rule-create --protocol <tcp|udp|icmp|any> --destination-port <port-range> --action <allow|deny>
Copy to Clipboard Toggle word wrap

The CLI requires a protocol value; if the rule is protocol agnostic, the any value can be used.

2. Create a firewall policy: 

$ neutron firewall-policy-create --firewall-rules "<firewall-rule IDs or names separated by space>" myfirewallpolicy
Copy to Clipboard Toggle word wrap

The order of the rules specified above is important. You can create an empty firewall policy and add rules later, either with the update operation (when adding multiple rules) or with the insert-rule operations (when adding a single rule).

Note: FWaaS always adds a default deny all rule at the lowest precedence of each policy. Consequently, a firewall policy with no rules blocks all traffic by default.

19.3. Create a firewall
Copiar enlace

$ neutron firewall-create <firewall-policy-uuid>
Copy to Clipboard Toggle word wrap

The firewall remains in PENDING_CREATE state until an OpenStack Networking router is created, and an interface is attached.

19.4. Allowed-address-pairs
Copiar enlace

Allowed-address-pairs allow you to specify mac_address/ip_address (CIDR) pairs that pass through a port regardless of subnet. This enables the use of protocols such as VRRP, which floats an IP address between two instances to enable fast data plane failover.

Note

The allowed-address-pairs extension is currently only supported by these plug-ins: ML2, Open vSwitch, and VMware NSX.

19.4.1. Basic allowed-address-pairs operations
Copiar enlace

Create a port with a specific allowed-address-pairs: 

# neutron port-create net1 --allowed-address-pairs type=dict list=true mac_address=<mac_address>,ip_address=<ip_cidr>
Copy to Clipboard Toggle word wrap

19.4.2. Adding allowed-address-pairs
Copiar enlace

# neutron port-update <port-uuid> --allowed-address-pairs type=dict list=true mac_address=<mac_address>,ip_address=<ip_cidr>
Copy to Clipboard Toggle word wrap
Note

OpenStack Networking prevents setting an allowed-address-pair that matches the mac_address and ip_address of a port. This is because such a setting would have no effect since traffic matching the mac_address and ip_address is already allowed to pass through the port.

Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat