8.8. 示例 1 - 将防火墙组应用到路由器端口

流程

1. 从您的工作站访问 OpenStackClient pod 的远程 shell：

   $ oc rsh openstackclient

2. 检索路由器的内部端口 ID：

   $ openstack port list --router <router-name> --network <private-network-name>

   命令输出类似如下：

   +--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
   | ID                                   | Name | MAC Address       | Fixed IP Addresses                                                         | Status |
   +--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+
   | 8c6812eb-b8b4-492d-b275-10ecbda21901 |      | fa:16:3e:b3:eb:95 | ip_address='192.168.1.1', subnet_id='ab31dc3d-cc67-4288-a1c3-c2eb65f9a184' | ACTIVE |
   +--------------------------------------+------+-------------------+----------------------------------------------------------------------------+--------+

3. 创建 firewall 组，并使用上一步中检索到的 ID 将它应用到端口：

   $ openstack firewall group create --ingress-firewall-policy <policy-name> --port <router-port-id> --name <fw-group-name>

   其中：

   • <policy_name > : 指定防火墙策略的名称。
   • <router_port_id > : 指定上一步中检索到的路由器端口 ID。

   • <fw_group_name > : 指定您要分配给这个防火墙组的名称。

     命令输出类似如下：

     +-------------------+------------------------------------------+
     | Field             | Value                                    |
     +-------------------+------------------------------------------+
     | Description       |                                          |
     | Egress Policy ID  | None                                     |
     | ID                | 71f13cd2-a6a9-449d-8c76-3afc576a619b     |
     | Ingress Policy ID | 55063d58-73b6-4366-9cc9-461a69dbe61f     |
     | Name              | my-fw-group                              |
     | Ports             | ['8c6812eb-b8b4-492d-b275-10ecbda21901'] |
     | Project           | 3302eebb4fba4b06bd30724463e37ba2         |
     | Shared            | False                                    |
     | State             | UP                                       |
     | Status            | ACTIVE                                   |
     | created_at        | 2026-05-26T16:53:18Z                     |
     | project_id        | 3302eebb4fba4b06bd30724463e37ba2         |
     | revision_number   | 0                                        |
     | tags              | []                                       |
     | updated_at        | 2026-05-26T16:53:18Z                     |
     +-------------------+------------------------------------------+

4. 退出 openstackclient pod:

   $ exit