首页 > 代码库 > Neutron - Fwaas配置

Neutron - Fwaas配置

2024-07-25 22:27:41   213人阅读

Fwaas简介

FWaaS uses iptables to apply firewall policy to all Networking routers within a project.(这些iptables规则存在于router的namespace)
FWaaS supports one firewall policy and logical firewall instance per project.(官方介绍，本人翻译水平有限)

FWaaS is currently in technical preview; untested operation is not recommended.(Fwaas现在只是技术性实现，不建议一些未经测试的操作)


Fwaas和Security group的区别

Fwaas的iptables规则存在于router的namespace中(主要关注filter表)

Security group的iptables规则存在于虚拟机所在的compute节点(主要关注filter表)


这篇博客是介绍neutron中的iptables，总结得很不错。http://lingxiankong.github.io/blog/2013/11/19/iptables-in-neutron/


Fwaas架构

wKioL1Qzy92DkuCWAALO_IRYpUY635.jpg


具体配置

[root@controller1 neutron]# vim /etc/neutron/neutron.conf  # 编辑neutron.conf配置文件，添加如下内容
[DEFAULT]
service_plugins = firewall[service_providers]service_provider = FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver:default[fwaas]driver = neutron.services.firewall.drivers.linux.iptables_fwaas.IptablesFwaasDriverenabled = True
[root@controller1 neutron]# vim /etc/openstack-dashboard/local_settings  # 编辑dashboard配置文件
‘enable_firewall‘: True,   # 在dashboard上启用Fwaas面板，默认是False
[root@controller1~]# service neutron-server restart   # 重启相应服务生效
Stopping neutron:                                          [  OK  ]
Starting neutron:                                          [  OK  ]
[root@controller1~]# service neutron-l3-agent restart
Stopping neutron-l3-agent:                                 [  OK  ]
Starting neutron-l3-agent:                                 [  OK  ]
[root@controller1~]# service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]


Fwaas使用

又来到animbus界面，图文并茂奉上j_0061.gif！

1 添加防火墙规则

wKioL1Qz1dbzaS1aAAN0BBeWPB4331.jpg

点击左边区域的“放火墙“，显示如右边区域所示


点击右边区域的”添加规则”，填写相应信息

wKiom1Qz1qWj5X7BAAFcgRk3FWU273.jpg

点击“添加“


2 添加防火墙策略

wKiom1Qz13PQmuSGAADwT8mkAq8450.jpg

wKiom1Qz13SAjaF3AAEIwSwFHp0685.jpg


3 创建防火墙

wKioL1Qz2E7hEzNdAADufBQIq2U135.jpg


这里有一点要注意：

The firewall remains in PENDING_CREATE state until you create a Networking router and attach an interface to it.(应该都看得懂这句话的意思吧)


参考链接

http://niusmallnan.github.io/_build/html/_templates/openstack/fwaas_setup.html

https://wiki.openstack.org/wiki/Neutron/FWaaS/HowToInstall

本文出自 “the-way-to-cloud” 博客，请务必保留此出处http://iceyao.blog.51cto.com/9426658/1561057

Neutron - Fwaas配置


联系
我们