Create a cloud firewall

Create a cloud firewall

carefully

A cloud firewall has a basic property: all inbound and outbound traffic that is not allowed is denied. If you create a firewall without rules and assign it to a cloud router port, all traffic on the router's subnet will be denied. After creating a firewall on the router, all active sessions will be terminated.

Control panel

1. In Control Panel, go to Cloud Platform → Firewalls.

2. Click Create Firewall.

3. Select pool where the firewall will be created.

4. Optional: select a private subnet with the cloud router for which you want to configure traffic filtering. A firewall is assigned to a cloud router port on this private subnet.

   Assign firewall to router port can be done after the firewall is created.

5. Select the direction of traffic:

Входящий трафик

6. If the templates with rules for inbound traffic are appropriate for you, click the rule. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Go to step 14.

7. If there is no suitable template, add your own rule for incoming traffic. Click Add Incoming Traffic Rule.

8. Select an action:

   • Allow — Allow traffic;
   • Deny — Deny traffic.

9. Select a protocol: ICMP, TCP, UDP or All (Any).

10. Enter the traffic source (Source) — IP address, subnet, or all addresses (Any).

11. Enter the source port (Src. port) — a single port, a range of ports, or all ports (Any).

12. Enter the traffic destination (Destination) — IP address, subnet, or Any. If you specify a subnet, the rule will apply to all devices on the subnet.

13. Enter the destination port (Dst. port) — a single port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Servercore by default, will be denied even if you specify that port in the rule.

14. Enter a name for the rule or leave the name created automatically.

15. Optional: enter a comment for the rule.

16. Press Add. After the firewall is created, you can edit the rule.

Исходящий трафик

6. If the templates with rules for outbound traffic are appropriate for you, click the rule. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Go to step 14.

7. If there is no suitable template, add your own rule for outbound traffic. Click Add Outbound Traffic Rule.

8. Select an action:

   • Allow — Allow traffic;
   • Deny — Deny traffic.

9. Select a protocol: ICMP, TCP, UDP or All (Any).

10. Enter the traffic source (Source) — IP address, subnet, or all addresses (Any). If you specify a subnet, the rule will apply to all devices on the subnet.

11. Enter the source port (Src. port) — a single port, a range of ports, or all ports (Any).

12. Enter the traffic destination (Destination) — IP address, subnet, or Any.

13. Enter the destination port (Dst. port) — a single port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Servercore by default, will be denied even if you specify that port in the rule.

14. Enter a name for the rule or leave the name created automatically.

15. Optional: enter a comment for the rule.

16. Press Add. After the firewall is created, you can edit the rule.

17. Check the order of the rules, they are executed in order in the list — top to bottom. If necessary, change the order — drag and drop rules. After the firewall is created, you can change the order of the rules.
18. Optional: To add another rule to the firewall, go to step 5. You can add up to 100 rules per traffic direction.
19. Enter the name of the firewall or leave the name created automatically.
20. Optional: enter a comment for the firewall.
21. Click Create Firewall.

OpenStack CLI

1. Open OpenStack CLI.

2. Create a rule:

   openstack firewall group rule create \
       --action <action> \
       --protocol <protocol> \
       [--source-ip-address <source_ip_address> | --no-source-ip-address] \
       [--source-port <source_port> | --no-source-port] \
       [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
       [--destination-port <destination_port> | --no-destination-port]

   Specify:

   • <action> is the action:

     • allow — allow traffic;
     • deny — reject traffic;

   • <protocol> — protocol:

     • icmp — ICMP;
     • tcp — TCP;
     • udp — UDP;
     • any — all protocols;

   • traffic source:

     • --source-ip-address <source_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to a policy for outbound traffic, the rule will apply to all devices on the subnet;
     • --no-source-ip-address — all addresses (Any);

   • source port:

     • --source-port <source_port> — a single port or range of ports;
     • --no-source-port — all ports (Any);

   • traffic assignment:

     • --destination-ip-address <destination_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to a policy for inbound traffic, the rule will take effect on all devices on the subnet;
     • --no-destination-ip-address — all addresses (Any);

   • port of call:

     • --destination-port <destination_port> — a single port or range of ports;

     • --no-destination-port — all ports (Any).

       Traffic to any TCP/UDP port blocked in Servercore by default, will be denied even if you specify that port in the rule.

3. Create a policy for the firewall:

   openstack firewall group policy create \
       --firewall-rule <firewall_rule> \
       <policy_name>

   Specify:

   • <firewall_rule> — The ID or name of the rule. The list can be viewed using the openstack firewall firewall group rule list. To add multiple rules, separate their names or IDs with a space. Check the order of the rules, they are executed in order;
   • <policy_name> is the name of the policy.

4. Create a firewall:

   openstack firewall group create \
       [--ingress-firewall-policy <firewall_ingress_policy> | --no-ingress-firewall-policy] \
       [--egress-firewall-policy <firewall_egress_policy> | --no-egress-firewall-policy] \
       --port <router_port>

   Specify:

   • policy for inbound traffic:
     • --ingress-firewall-policy <firewall_ingress_policy> — The ID or name of the policy for inbound traffic. The list can be viewed with openstack firewall group policy list. You can add only one policy for inbound traffic;
     • --no-ingress-firewall-policy — Specify if there is no policy for inbound traffic;
   • policy for outbound traffic:
     • --egress-firewall-policy <firewall_egress_policy> — The ID or name of the policy for outgoing traffic. The list can be viewed with openstack firewall group policy list. You can add only one policy for outbound traffic;
     • --no-egress-firewall-policy — Specify if there is no policy for outgoing traffic;
   • <router_port> — ID or port name of the router to which the firewall will be assigned. The list can be viewed with openstack port list. To assign a firewall to more than one router port, list their names or IDs separated by a space.