OpenStack
安全组(Security Group)
默认是通过 Linux iptables
实现的,本文介绍 Neutron
基于 iptables
实现的安全组。
启用 iptables 安全组
修改 /etc/neutron/plugins/ml2/ml2_conf.ini
配置文件
[securitygroup]
firewall_driver = neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver
重启服务
sudo systemctl restart devstack@q-*
默认的 iptables 规则
通过 iptables-save
命令可以看到的流被转发到 neutron-openvswi-x
的链中:
$ sudo iptables-save
...
-A INPUT -j neutron-openvswi-INPUT # 将 INPUT 转到 neutron-openvswi-INPUT 链
-A FORWARD -j neutron-filter-top
-A FORWARD -j neutron-openvswi-FORWARD # 将 FORWARD 转到 neutron-openvswi-FORWARD 链
-A OUTPUT -j neutron-filter-top
-A OUTPUT -j neutron-openvswi-OUTPUT # 将 OUTPUT 转到 neutron-openvswi-OUTPUT 链
-A neutron-filter-top -j neutron-openvswi-local
...
查看 Chain
信息如下:
stack@xiexianbin-vm:~$ sudo iptables -nvL
Chain INPUT (policy ACCEPT 24762 packets, 6088K bytes)
pkts bytes target prot opt in out source destination
24762 6088K neutron-openvswi-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0
58550 14M LIBVIRT_INP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 neutron-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 neutron-openvswi-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LIBVIRT_FWX all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LIBVIRT_FWI all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LIBVIRT_FWO all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 24381 packets, 5993K bytes)
pkts bytes target prot opt in out source destination
24381 5993K neutron-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0
24381 5993K neutron-openvswi-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
57654 14M LIBVIRT_OUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain LIBVIRT_FWI (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain LIBVIRT_FWO (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0
0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain LIBVIRT_FWX (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0
Chain LIBVIRT_INP (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
Chain LIBVIRT_OUT (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- * virbr0 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68
0 0 ACCEPT tcp -- * virbr0 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
Chain neutron-filter-top (2 references)
pkts bytes target prot opt in out source destination
24381 5993K neutron-openvswi-local all -- * * 0.0.0.0/0 0.0.0.0/0
Chain neutron-openvswi-FORWARD (1 references)
pkts bytes target prot opt in out source destination
Chain neutron-openvswi-INPUT (1 references)
pkts bytes target prot opt in out source destination
Chain neutron-openvswi-OUTPUT (1 references)
pkts bytes target prot opt in out source destination
Chain neutron-openvswi-local (1 references)
pkts bytes target prot opt in out source destination
Chain neutron-openvswi-sg-chain (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain neutron-openvswi-sg-fallback (0 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* Default drop rule for unmatched traffic. */
默认初始化的 iptables Chain
链如下:
- neutron-filter-top
- neutron-openvswi-FORWARD # neutron 定义的 FORWARD 链
- neutron-openvswi-INPUT # neutron 定义的 INPUT 链
- neutron-openvswi-OUTPUT # neutron 定义的 OUTPUT 链
- neutron-openvswi-local
- neutron-openvswi-sg-chain
- neutron-openvswi-sg-fallback
创建网络和子网
stack@xiexianbin-vm:/etc/neutron$ openstack network create demo --share --enable
+---------------------------+--------------------------------------+
| Field | Value |
+---------------------------+--------------------------------------+
| admin_state_up | UP |
| availability_zone_hints | |
| availability_zones | |
| created_at | 2021-01-03T00:59:49Z |
| description | |
| dns_domain | None |
| id | 557bc377-cece-41dd-8b77-1348355ff66c |
| ipv4_address_scope | None |
| ipv6_address_scope | None |
| is_default | False |
| is_vlan_transparent | None |
| mtu | 1450 |
| name | demo |
| port_security_enabled | True |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| provider:network_type | vxlan |
| provider:physical_network | None |
| provider:segmentation_id | 1 |
| qos_policy_id | None |
| revision_number | 1 |
| router:external | Internal |
| segments | None |
| shared | True |
| status | ACTIVE |
| subnets | |
| tags | |
| updated_at | 2021-01-03T00:59:49Z |
+---------------------------+--------------------------------------+
stack@xiexianbin-vm:~$ openstack network list
+--------------------------------------+------+---------+
| ID | Name | Subnets |
+--------------------------------------+------+---------+
| 557bc377-cece-41dd-8b77-1348355ff66c | demo | |
+--------------------------------------+------+---------+
stack@xiexianbin-vm:/etc/neutron$ openstack subnet create sub-demo --subnet-range 10.0.0.0/24 --dhcp --ip-version 4 --network demo
+----------------------+--------------------------------------+
| Field | Value |
+----------------------+--------------------------------------+
| allocation_pools | 10.0.0.2-10.0.0.254 |
| cidr | 10.0.0.0/24 |
| created_at | 2021-01-03T01:00:48Z |
| description | |
| dns_nameservers | |
| dns_publish_fixed_ip | None |
| enable_dhcp | True |
| gateway_ip | 10.0.0.1 |
| host_routes | |
| id | 3768efcb-e21e-4293-a1f9-596e28a21cb5 |
| ip_version | 4 |
| ipv6_address_mode | None |
| ipv6_ra_mode | None |
| name | sub-demo |
| network_id | 557bc377-cece-41dd-8b77-1348355ff66c |
| prefix_length | None |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| revision_number | 0 |
| segment_id | None |
| service_types | |
| subnetpool_id | None |
| tags | |
| updated_at | 2021-01-03T01:00:48Z |
+----------------------+--------------------------------------+
stack@xiexianbin-vm:/etc/neutron$ openstack subnet list
stack@xiexianbin-vm:~$ openstack subnet list
+--------------------------------------+----------+--------------------------------------+-------------+
| ID | Name | Network | Subnet |
+--------------------------------------+----------+--------------------------------------+-------------+
| 3768efcb-e21e-4293-a1f9-596e28a21cb5 | sub-demo | 557bc377-cece-41dd-8b77-1348355ff66c | 10.0.0.0/24 |
+--------------------------------------+----------+--------------------------------------+-------------+
stack@xiexianbin-vm:~$ openstack port list
+--------------------------------------+------+-------------------+-------------------------------------------------------------------------+--------+
| ID | Name | MAC Address | Fixed IP Addresses | Status |
+--------------------------------------+------+-------------------+-------------------------------------------------------------------------+--------+
| 190045e5-4415-4599-bea2-9eb5a8f73b7d | | fa:16:3e:a3:28:f3 | ip_address='10.0.0.2', subnet_id='3768efcb-e21e-4293-a1f9-596e28a21cb5' | ACTIVE |
+--------------------------------------+------+-------------------+-------------------------------------------------------------------------+--------+
可以发现已经分配了一个ip地址 10.0.0.2
,该地址为 dhcp
的地址,接下来我们从 netns
、OVS
等方面查看他的信息。
netns 信息
创建子网(并启用dhcp
)时,创建的 netns 信息如下,可以看到 tap190045e5-44
已经在该 netns
中,对应的地址为: 10.0.0.2/24
stack@xiexianbin-vm:~$ ip netns
qdhcp-557bc377-cece-41dd-8b77-1348355ff66c (id: 0)
stack@xiexianbin-vm:~$ sudo ip netns exec qdhcp-557bc377-cece-41dd-8b77-1348355ff66c ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
10: tap190045e5-44: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/ether fa:16:3e:a3:28:f3 brd ff:ff:ff:ff:ff:ff
stack@xiexianbin-vm:~$ sudo ip netns exec qdhcp-557bc377-cece-41dd-8b77-1348355ff66c ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
10: tap190045e5-44: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether fa:16:3e:a3:28:f3 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.2/24 brd 10.0.0.255 scope global tap190045e5-44
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fea3:28f3/64 scope link
valid_lft forever preferred_lft forever
OVS 信息
tap190045e5-44
绑定在 br-int
网桥上,tag
为 1
,为该网络提供 dhcp
功能。
stack@xiexianbin-vm:~$ sudo ovs-vsctl show
0976470f-8041-45d1-ad1a-34cd061684d3
Manager "ptcp:6640:127.0.0.1"
is_connected: true
Bridge br-ex
Controller "tcp:127.0.0.1:6633"
is_connected: true
fail_mode: secure
datapath_type: system
Port br-ex
Interface br-ex
type: internal
Port phy-br-ex
Interface phy-br-ex
type: patch
options: {peer=int-br-ex}
Bridge br-tun
Controller "tcp:127.0.0.1:6633"
is_connected: true
fail_mode: secure
datapath_type: system
Port br-tun
Interface br-tun
type: internal
Port patch-int
Interface patch-int
type: patch
options: {peer=patch-tun}
Bridge br-int
Controller "tcp:127.0.0.1:6633"
is_connected: true
fail_mode: secure
datapath_type: system
Port br-int
Interface br-int
type: internal
Port int-br-ex
Interface int-br-ex
type: patch
options: {peer=phy-br-ex}
Port tap190045e5-44
tag: 1
Interface tap190045e5-44
type: internal
Port patch-tun
Interface patch-tun
type: patch
options: {peer=patch-int}
ovs_version: "2.13.1"
stack@xiexianbin-vm:~$ sudo ovs-ofctl show br-int
OFPT_FEATURES_REPLY (xid=0x2): dpid:0000a62b2fabc24d
n_tables:254, n_buffers:0
capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
actions: output enqueue set_vlan_vid set_vlan_pcp strip_vlan mod_dl_src mod_dl_dst mod_nw_src mod_nw_dst mod_nw_tos mod_tp_src mod_tp_dst
1(int-br-ex): addr:3e:e4:b9:12:01:57
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
2(patch-tun): addr:96:5e:3a:be:41:08
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
3(tap190045e5-44): addr:fa:16:3e:a3:28:f3
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
LOCAL(br-int): addr:a6:2b:2f:ab:c2:4d
config: PORT_DOWN
state: LINK_DOWN
speed: 0 Mbps now, 0 Mbps max
OFPT_GET_CONFIG_REPLY (xid=0x4): frags=normal miss_send_len=0
iptables 信息
通过 iptables
规则,默认把所有流量转发到 tap190045e5-44
,iptables
信息如下:
stack@xiexianbin-vm:~$ sudo iptables -nvL
Chain neutron-openvswi-FORWARD (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap190045e5-44 --physdev-is-bridged /* Accept all packets when port is trusted. */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap190045e5-44 --physdev-is-bridged /* Accept all packets when port is trusted. */
neutron-dhcp-agent
通过该 tap
设备为该 network
提供 dhcp
功能。TODO(xiexianbin)
安全组信息
默认情况下,对所有 ipv4/6
出的流量和本安全组内的流量不限制:
stack@xiexianbin-vm:~$ openstack security group list
+--------------------------------------+---------+------------------------+----------------------------------+------+
| ID | Name | Description | Project | Tags |
+--------------------------------------+---------+------------------------+----------------------------------+------+
| 22b33e63-0f84-4bbc-a797-7c3d7ae107aa | default | Default security group | 45837e6267c44d7788a919d6e342e64c | [] |
+--------------------------------------+---------+------------------------+----------------------------------+------+
stack@xiexianbin-vm:~$ openstack security group rule list 22b33e63-0f84-4bbc-a797-7c3d7ae107aa
+--------------------------------------+-------------+-----------+-----------+------------+--------------------------------------+
| ID | IP Protocol | Ethertype | IP Range | Port Range | Remote Security Group |
+--------------------------------------+-------------+-----------+-----------+------------+--------------------------------------+
| 09c623fc-bf1f-46bf-9149-facdc6148831 | None | IPv6 | ::/0 | | None |
| 0f709d8c-7400-40dd-a5b7-59beaee93c74 | None | IPv6 | ::/0 | | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| 366c1188-988b-4c5a-8bf4-dfcec6fb902f | None | IPv4 | 0.0.0.0/0 | | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| 6ff01e6d-9b34-433c-968f-c04495098145 | None | IPv4 | 0.0.0.0/0 | | None |
+--------------------------------------+-------------+-----------+-----------+------------+--------------------------------------+
stack@xiexianbin-vm:~$ openstack security group show 22b33e63-0f84-4bbc-a797-7c3d7ae107aa
...
| rules | created_at='2021-01-03T01:25:18Z', direction='egress', ethertype='IPv6', id='09c623fc-bf1f-46bf-9149-facdc6148831', updated_at='2021-01-03T01:25:18Z' |
| | created_at='2021-01-03T01:25:18Z', direction='ingress', ethertype='IPv6', id='0f709d8c-7400-40dd-a5b7-59beaee93c74', remote_group_id='22b33e63-0f84-4bbc-a797-7c3d7ae107aa', updated_at='2021-01-03T01:25:18Z' |
| | created_at='2021-01-03T01:25:18Z', direction='ingress', ethertype='IPv4', id='366c1188-988b-4c5a-8bf4-dfcec6fb902f', remote_group_id='22b33e63-0f84-4bbc-a797-7c3d7ae107aa', updated_at='2021-01-03T01:25:18Z' |
| | created_at='2021-01-03T01:25:18Z', direction='egress', ethertype='IPv4', id='6ff01e6d-9b34-433c-968f-c04495098145', updated_at='2021-01-03T01:25:18Z' |
...
创建 VM
stack@xiexianbin-vm:~$ openstack server create demo-1 --image cirros-0.5.1-x86_64-disk --flavor m1.tiny --security-group 22b33e63-0f84-4bbc-a797-7c3d7ae107aa --network 557bc377-cece-41dd-8b77-1348355ff66c
+-------------------------------------+-----------------------------------------------------------------+
| Field | Value |
+-------------------------------------+-----------------------------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | |
| OS-EXT-SRV-ATTR:host | None |
| OS-EXT-SRV-ATTR:hypervisor_hostname | None |
| OS-EXT-SRV-ATTR:instance_name | |
| OS-EXT-STS:power_state | NOSTATE |
| OS-EXT-STS:task_state | scheduling |
| OS-EXT-STS:vm_state | building |
| OS-SRV-USG:launched_at | None |
| OS-SRV-USG:terminated_at | None |
| accessIPv4 | |
| accessIPv6 | |
| addresses | |
| adminPass | zA2XHUku6vAM |
| config_drive | |
| created | 2021-01-03T01:30:53Z |
| flavor | m1.tiny (1) |
| hostId | |
| id | a9afb91b-8700-4901-9565-5bf6a63f0143 |
| image | cirros-0.5.1-x86_64-disk (000fcfa3-7ffa-4125-817e-cf7a27cf3eb1) |
| key_name | None |
| name | demo-1 |
| progress | 0 |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| properties | |
| security_groups | name='22b33e63-0f84-4bbc-a797-7c3d7ae107aa' |
| status | BUILD |
| updated | 2021-01-03T01:30:52Z |
| user_id | c6b926ebfb5c4a6db670150b183581af |
| volumes_attached | |
+-------------------------------------+-----------------------------------------------------------------+
stack@xiexianbin-vm:~$ openstack port list --server a9afb91b-8700-4901-9565-5bf6a63f0143
+--------------------------------------+------+-------------------+--------------------------------------------------------------------------+--------+
| ID | Name | MAC Address | Fixed IP Addresses | Status |
+--------------------------------------+------+-------------------+--------------------------------------------------------------------------+--------+
| 33d3e592-c6eb-4cb3-8266-33c8e2e1f646 | | fa:16:3e:57:1c:cd | ip_address='10.0.0.29', subnet_id='3768efcb-e21e-4293-a1f9-596e28a21cb5' | ACTIVE |
+--------------------------------------+------+-------------------+--------------------------------------------------------------------------+--------+
stack@xiexianbin-vm:~$ openstack port show 33d3e592-c6eb-4cb3-8266-33c8e2e1f646
+-------------------------+-------------------------------------------------------------------------------------------------------------+
| Field | Value |
+-------------------------+-------------------------------------------------------------------------------------------------------------+
| admin_state_up | UP |
| allowed_address_pairs | |
| binding_host_id | xiexianbin-vm |
| binding_profile | |
| binding_vif_details | bridge_name='br-int', connectivity='l2', datapath_type='system', ovs_hybrid_plug='True', port_filter='True' |
| binding_vif_type | ovs |
| binding_vnic_type | normal |
| created_at | 2021-01-03T01:30:54Z |
| data_plane_status | None |
| description | |
| device_id | a9afb91b-8700-4901-9565-5bf6a63f0143 |
| device_owner | compute:nova |
| dns_assignment | None |
| dns_domain | None |
| dns_name | None |
| extra_dhcp_opts | |
| fixed_ips | ip_address='10.0.0.29', subnet_id='3768efcb-e21e-4293-a1f9-596e28a21cb5' |
| id | 33d3e592-c6eb-4cb3-8266-33c8e2e1f646 |
| ip_allocation | None |
| mac_address | fa:16:3e:57:1c:cd |
| name | |
| network_id | 557bc377-cece-41dd-8b77-1348355ff66c |
| numa_affinity_policy | None |
| port_security_enabled | True |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| propagate_uplink_status | None |
| qos_network_policy_id | None |
| qos_policy_id | None |
| resource_request | None |
| revision_number | 4 |
| security_group_ids | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| status | ACTIVE |
| tags | |
| trunk_details | None |
| updated_at | 2021-01-03T01:31:00Z |
+-------------------------+-------------------------------------------------------------------------------------------------------------+
发现:
- 每个
port
均和 security_group_ids
绑定,并且一个 port
上可以绑定多个安全组
查看 OVS 信息
发现 br-int
上新增了一个 qvo33d3e592-c6
,该网桥名称为 qvo<port-id-prefix-11>
组成,信息如下:
stack@xiexianbin-vm:~$ sudo ovs-vsctl show
0976470f-8041-45d1-ad1a-34cd061684d3
Manager "ptcp:6640:127.0.0.1"
is_connected: true
Bridge br-ex
Controller "tcp:127.0.0.1:6633"
is_connected: true
fail_mode: secure
datapath_type: system
Port br-ex
Interface br-ex
type: internal
Port phy-br-ex
Interface phy-br-ex
type: patch
options: {peer=int-br-ex}
Bridge br-tun
Controller "tcp:127.0.0.1:6633"
is_connected: true
fail_mode: secure
datapath_type: system
Port br-tun
Interface br-tun
type: internal
Port patch-int
Interface patch-int
type: patch
options: {peer=patch-tun}
Bridge br-int
Controller "tcp:127.0.0.1:6633"
is_connected: true
fail_mode: secure
datapath_type: system
Port br-int
Interface br-int
type: internal
Port qvo33d3e592-c6
tag: 1
Interface qvo33d3e592-c6
Port int-br-ex
Interface int-br-ex
type: patch
options: {peer=phy-br-ex}
Port tap190045e5-44
tag: 1
Interface tap190045e5-44
type: internal
Port patch-tun
Interface patch-tun
type: patch
options: {peer=patch-int}
ovs_version: "2.13.1"
stack@xiexianbin-vm:~$ sudo ovs-ofctl show br-int
OFPT_FEATURES_REPLY (xid=0x2): dpid:0000a62b2fabc24d
n_tables:254, n_buffers:0
capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
actions: output enqueue set_vlan_vid set_vlan_pcp strip_vlan mod_dl_src mod_dl_dst mod_nw_src mod_nw_dst mod_nw_tos mod_tp_src mod_tp_dst
1(int-br-ex): addr:3e:e4:b9:12:01:57
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
2(patch-tun): addr:96:5e:3a:be:41:08
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
3(tap190045e5-44): addr:fa:16:3e:a3:28:f3
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
4(qvo33d3e592-c6): addr:0a:d6:fb:38:47:33
config: 0
state: 0
current: 10GB-FD COPPER
speed: 10000 Mbps now, 0 Mbps max
LOCAL(br-int): addr:a6:2b:2f:ab:c2:4d
config: PORT_DOWN
state: LINK_DOWN
speed: 0 Mbps now, 0 Mbps max
OFPT_GET_CONFIG_REPLY (xid=0x4): frags=normal miss_send_len=0
veth-pair 信息
通过 ip addr show
命令,我们发现 qvo33d3e592-c6
是 veth-pair的一个,另一个为 qvb33d3e592-c6
绑定在 Linux bridge
qbr33d3e592-c6
上
stack@xiexianbin-vm:~$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:4b:60:15 brd ff:ff:ff:ff:ff:ff
inet 192.168.179.9/24 brd 192.168.179.255 scope global dynamic noprefixroute ens33
valid_lft 82201sec preferred_lft 82201sec
inet6 fe80::5d9a:faaa:c5fe:dfb/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: ens38: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:4b:60:1f brd ff:ff:ff:ff:ff:ff
inet 172.20.0.2/24 brd 172.20.0.255 scope global dynamic noprefixroute ens38
valid_lft 82201sec preferred_lft 82201sec
inet6 fe80::2b5:9fdf:5bc3:87b6/64 scope link noprefixroute
valid_lft forever preferred_lft forever
4: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether aa:7c:37:6e:3e:d4 brd ff:ff:ff:ff:ff:ff
5: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether b6:97:c7:9b:a9:45 brd ff:ff:ff:ff:ff:ff
6: br-int: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN group default qlen 1000
link/ether a6:2b:2f:ab:c2:4d brd ff:ff:ff:ff:ff:ff
7: br-ex: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 36:77:2d:10:6d:43 brd ff:ff:ff:ff:ff:ff
...
12: qvo33d3e592-c6@qvb33d3e592-c6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP group default qlen 1000
link/ether 0a:d6:fb:38:47:33 brd ff:ff:ff:ff:ff:ff
inet6 fe80::8d6:fbff:fe38:4733/64 scope link
valid_lft forever preferred_lft forever
13: qvb33d3e592-c6@qvo33d3e592-c6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master qbr33d3e592-c6 state UP group default qlen 1000
link/ether 3a:6d:32:cc:34:4a brd ff:ff:ff:ff:ff:ff
inet6 fe80::386d:32ff:fecc:344a/64 scope link
valid_lft forever preferred_lft forever
Linux bridge 信息
发现新增了一个 qbr33d3e592-c6
,该网桥名称为 qbr<port-id-prefix-11>
组成,基于 iptables
实现的安全组规则将基于此网桥实现。
stack@xiexianbin-vm:~$ sudo ip a show type bridge
11: qbr33d3e592-c6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default qlen 1000
link/ether 3a:6d:32:cc:34:4a brd ff:ff:ff:ff:ff:ff
tap 信息
同样的,通过 ip addr show
命令,我们发现网桥 qbr33d3e592-c6
还绑定这一个 tap 设备
TODO(xiexianbin),名称为 tap33d3e592-c6
stack@xiexianbin-vm:~$ ip addr show
...
14: tap33d3e592-c6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc fq_codel master qbr33d3e592-c6 state UNKNOWN group default qlen 1000
link/ether fe:16:3e:57:1c:cd brd ff:ff:ff:ff:ff:ff
inet6 fe80::fc16:3eff:fe57:1ccd/64 scope link
valid_lft forever preferred_lft forever
...
云主机使用 tap 设备
通过 ps -ef|grep qemu
查看当前使用qemu
TODO(xiexianbin)虚拟化的主机进程为 5369
-netdev tap,fd=32,id=hostnet0
,(TODO(xiexianbin)什么是fd)通过如下命令发现,该主机使用的就是 tap33d3e592-c6
stack@xiexianbin-vm:~$ sudo cat /proc/5369/fdinfo/32
pos: 82
flags: 0104002
mnt_id: 27
iff: tap33d3e592-c6
至此,我们已经将云主机怎么与br-int
连接介绍清楚。
iptables 信息
创建 vm
后,iptables
规则变化如下:
$ iptables -nvL
...
Chain neutron-openvswi-FORWARD (1 references)
pkts bytes target prot opt in out source destination
7 1116 neutron-openvswi-sg-chain all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap33d3e592-c6 --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */
13 1504 neutron-openvswi-sg-chain all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap33d3e592-c6 --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap190045e5-44 --physdev-is-bridged /* Accept all packets when port is trusted. */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap190045e5-44 --physdev-is-bridged /* Accept all packets when port is trusted. */
Chain neutron-openvswi-INPUT (1 references)
pkts bytes target prot opt in out source destination
0 0 neutron-openvswi-o33d3e592-c all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap33d3e592-c6 --physdev-is-bridged /* Direct incoming traffic from VM to the security group chain. */
Chain neutron-openvswi-OUTPUT (1 references)
pkts bytes target prot opt in out source destination
Chain neutron-openvswi-i33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
5 420 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */
2 696 RETURN udp -- * * 0.0.0.0/0 10.0.0.29 udp spt:67 dpt:68
0 0 RETURN udp -- * * 0.0.0.0/0 255.255.255.255 udp spt:67 dpt:68
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 match-set NIPv422b33e63-0f84-4bbc-a797- src
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */
0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */
Chain neutron-openvswi-o33d3e592-c (2 references)
pkts bytes target prot opt in out source destination
2 658 RETURN udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67 /* Allow DHCP client traffic. */
11 846 neutron-openvswi-s33d3e592-c all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:68 dpt:67 /* Allow DHCP client traffic. */
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 /* Prevent DHCP Spoofing by VM. */
4 336 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */
7 510 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */
0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */
Chain neutron-openvswi-s33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
11 846 RETURN all -- * * 10.0.0.29 0.0.0.0/0 MAC FA:16:3E:57:1C:CD /* Allow traffic from defined IP/MAC pairs. */
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* Drop traffic without an IP/MAC allow rule. */
Chain neutron-openvswi-sg-chain (2 references)
pkts bytes target prot opt in out source destination
7 1116 neutron-openvswi-i33d3e592-c all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap33d3e592-c6 --physdev-is-bridged /* Jump to the VM specific chain. */
13 1504 neutron-openvswi-o33d3e592-c all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap33d3e592-c6 --physdev-is-bridged /* Jump to the VM specific chain. */
20 2620 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
...
与该主机端口相关的,主要的 iptables Chain 如下:
neutron-openvswi-s33d3e592-c
:命令 neutron-openvswi-s<port-id-prefix-10>
,处理出该端口的网络包的防IP欺骗
neutron-openvswi-i33d3e592-c
:命令 neutron-openvswi-i<port-id-prefix-10>
,处理进该端口的网络包的防IP欺骗
neutron-openvswi-o33d3e592-c
:命令 neutron-openvswi-o<port-id-prefix-10>
,处理出该端口的网络包
以进入端口的链 neutron-openvswi-i33d3e592-c
为例,说明如下:
stack@xiexianbin-vm:~$ sudo iptables -nvL neutron-openvswi-i33d3e592-c
Chain neutron-openvswi-i33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
5 420 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */ # 放行已知会话相关联的信息包
2 696 RETURN udp -- * * 0.0.0.0/0 10.0.0.29 udp spt:67 dpt:68 # 放行到 10.0.0.29 的 utp 包
0 0 RETURN udp -- * * 0.0.0.0/0 255.255.255.255 udp spt:67 dpt:68 # 放行到 255.255.255.255 的 utp 包
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 match-set NIPv422b33e63-0f84-4bbc-a797- src # 放行到 0.0.0.0/0 匹配 ipset NIPv422b33e63-0f84-4bbc-a797- 的包
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */ # 丢弃 INVALID 的包
0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */ # 将不匹配的通信发送到回退链
stack@xiexianbin-vm:~$ sudo ipset list NIPv422b33e63-0f84-4bbc-a797-
Name: NIPv422b33e63-0f84-4bbc-a797-
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 512
References: 1
Number of entries: 1
Members:
10.0.0.29 # ipset 匹配 10.0.0.29
Linux ipset 使用介绍
新建防火墙规则对 iptables 的影响
新建允许从 10.1.0.0/24
ping 主机的规则到 default
安全组,命令如下:
stack@xiexianbin-vm:~$ openstack security group rule create 22b33e63-0f84-4bbc-a797-7c3d7ae107aa --remote-ip 10.1.0.0/24 --protocol icmp --ingress
+-------------------+--------------------------------------+
| Field | Value |
+-------------------+--------------------------------------+
| created_at | 2021-01-03T03:48:27Z |
| description | |
| direction | ingress |
| ether_type | IPv4 |
| id | 3588e58b-1890-4929-ab85-d5519ec1b7a7 |
| name | None |
| port_range_max | None |
| port_range_min | None |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| protocol | icmp |
| remote_group_id | None |
| remote_ip_prefix | 10.1.0.0/24 |
| revision_number | 0 |
| security_group_id | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| tags | [] |
| updated_at | 2021-01-03T03:48:27Z |
+-------------------+--------------------------------------+
查看 iptables
规则,多了一条:
$ iptables -nvL
Chain neutron-openvswi-i33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN icmp -- * * 10.1.0.0/24 0.0.0.0/0 # 放行从 `10.1.0.0/24` 发出的 icmp 包
至此,我们可以从 10.1.0.0/24
ping 通云主机,安全组规则生效。类似的出站规则也是这样工作。
allow_address_key_pairs
为 port 10.0.0.29
添加 allowed-address 0.0.0.0/0
,操作如下:
stack@xiexianbin-vm:~$ openstack port set 33d3e592-c6eb-4cb3-8266-33c8e2e1f646 --allowed-address ip-address=0.0.0.0/0
stack@xiexianbin-vm:~$ openstack port show 33d3e592-c6eb-4cb3-8266-33c8e2e1f646
+-------------------------+-------------------------------------------------------------------------------------------------------------+
| Field | Value |
+-------------------------+-------------------------------------------------------------------------------------------------------------+
| admin_state_up | UP |
| allowed_address_pairs | ip_address='0.0.0.0/0', mac_address='fa:16:3e:57:1c:cd' |
| binding_host_id | xiexianbin-vm |
| binding_profile | |
| binding_vif_details | bridge_name='br-int', connectivity='l2', datapath_type='system', ovs_hybrid_plug='True', port_filter='True' |
| binding_vif_type | ovs |
| binding_vnic_type | normal |
| created_at | 2021-01-03T01:30:54Z |
| data_plane_status | None |
| description | |
| device_id | a9afb91b-8700-4901-9565-5bf6a63f0143 |
| device_owner | compute:nova |
| dns_assignment | None |
| dns_domain | None |
| dns_name | None |
| extra_dhcp_opts | |
| fixed_ips | ip_address='10.0.0.29', subnet_id='3768efcb-e21e-4293-a1f9-596e28a21cb5' |
| id | 33d3e592-c6eb-4cb3-8266-33c8e2e1f646 |
| ip_allocation | None |
| mac_address | fa:16:3e:57:1c:cd |
| name | |
| network_id | 557bc377-cece-41dd-8b77-1348355ff66c |
| numa_affinity_policy | None |
| port_security_enabled | True |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| propagate_uplink_status | None |
| qos_network_policy_id | None |
| qos_policy_id | None |
| resource_request | None |
| revision_number | 5 |
| security_group_ids | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| status | ACTIVE |
| tags | |
| trunk_details | None |
| updated_at | 2021-01-03T03:56:17Z |
+-------------------------+-------------------------------------------------------------------------------------------------------------+
Chain neutron-openvswi-s33d3e592-c
增加一条对所有 0.0.0.0/0 FA:16:3E:57:1C:CD
地址来的流量放行的规则,如下:
Chain neutron-openvswi-s33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 MAC FA:16:3E:57:1C:CD /* Allow traffic from defined IP/MAC pairs. */
安全组规则没有发生变化(其他场景也可能新增 match-set
,本示例已经存在),我们查看 ipset
信息如下:
stack@xiexianbin-vm:~$ sudo ipset list NIPv422b33e63-0f84-4bbc-a797-
Name: NIPv422b33e63-0f84-4bbc-a797-
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 640
References: 1
Number of entries: 3
Members:
128.0.0.0/1
0.0.0.0/1 # 放行所有流量
10.0.0.29
从 ipset 看,当添加 --allowed-address ip-address=0.0.0.0/0
时,会放行所有流量,导致安全组失效。
因此,我们建议在生产环境,添加 --allowed-address
时,尽量指定地址范围,避免安全组失效的问题。指定 --allowed-address ip-address=10.0.0.128/26
时,ipset 信息如下:
stack@xiexianbin-vm:~$ sudo ipset list NIPv422b33e63-0f84-4bbc-a797-
Name: NIPv422b33e63-0f84-4bbc-a797-
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 640
References: 1
Number of entries: 3
Members:
128.0.0.0/1
10.0.0.128/26 # 放行指定网段流量
10.0.0.29
导致安全组失效,主要是自身添加了到自身安全组放行导致的,我们删除对应的规则,如下:
stack@xiexianbin-vm:~$ openstack security group list
+--------------------------------------+---------+------------------------+----------------------------------+------+
| ID | Name | Description | Project | Tags |
+--------------------------------------+---------+------------------------+----------------------------------+------+
| 22b33e63-0f84-4bbc-a797-7c3d7ae107aa | default | Default security group | 45837e6267c44d7788a919d6e342e64c | [] |
+--------------------------------------+---------+------------------------+----------------------------------+------+
stack@xiexianbin-vm:~$ openstack security group rule list 22b33e63-0f84-4bbc-a797-7c3d7ae107aa
+--------------------------------------+-------------+-----------+-------------+------------+--------------------------------------+
| ID | IP Protocol | Ethertype | IP Range | Port Range | Remote Security Group |
+--------------------------------------+-------------+-----------+-------------+------------+--------------------------------------+
| 09c623fc-bf1f-46bf-9149-facdc6148831 | None | IPv6 | ::/0 | | None |
| 0f709d8c-7400-40dd-a5b7-59beaee93c74 | None | IPv6 | ::/0 | | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| 3588e58b-1890-4929-ab85-d5519ec1b7a7 | icmp | IPv4 | 10.1.0.0/24 | | None |
| 366c1188-988b-4c5a-8bf4-dfcec6fb902f | None | IPv4 | 0.0.0.0/0 | | 22b33e63-0f84-4bbc-a797-7c3d7ae107aa |
| 6ff01e6d-9b34-433c-968f-c04495098145 | None | IPv4 | 0.0.0.0/0 | | None |
+--------------------------------------+-------------+-----------+-------------+------------+--------------------------------------+
stack@xiexianbin-vm:~$ openstack security group rule delete 0f709d8c-7400-40dd-a5b7-59beaee93c74 366c1188-988b-4c5a-8bf4-dfcec6fb902f
stack@xiexianbin-vm:~$ openstack security group rule list 22b33e63-0f84-4bbc-a797-7c3d7ae107aa
+--------------------------------------+-------------+-----------+-------------+------------+-----------------------+
| ID | IP Protocol | Ethertype | IP Range | Port Range | Remote Security Group |
+--------------------------------------+-------------+-----------+-------------+------------+-----------------------+
| 09c623fc-bf1f-46bf-9149-facdc6148831 | None | IPv6 | ::/0 | | None |
| 3588e58b-1890-4929-ab85-d5519ec1b7a7 | icmp | IPv4 | 10.1.0.0/24 | | None |
| 6ff01e6d-9b34-433c-968f-c04495098145 | None | IPv4 | 0.0.0.0/0 | | None |
+--------------------------------------+-------------+-----------+-------------+------------+-----------------------+
iptables
Chain neutron-openvswi-i33d3e592-c
对应的 ipset NIPv422b33e63-0f84-4bbc-a797-
也被删除,因此安全组可以正常工作,如下:
stack@xiexianbin-vm:~$ sudo iptables -nvL neutron-openvswi-i33d3e592-c
Chain neutron-openvswi-i33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
5 420 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */
2 696 RETURN udp -- * * 0.0.0.0/0 10.0.0.29 udp spt:67 dpt:68
0 0 RETURN udp -- * * 0.0.0.0/0 255.255.255.255 udp spt:67 dpt:68
0 0 RETURN icmp -- * * 10.1.0.0/24 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */
0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */
在管理其他安全组,观察ipset变化,如下:
stack@xiexianbin-vm:~$ openstack security group create demo-1
+-----------------+-------------------------------------------------------------------------------------------------------------------------------------------------------+
| Field | Value |
+-----------------+-------------------------------------------------------------------------------------------------------------------------------------------------------+
| created_at | 2021-01-03T05:29:25Z |
| description | demo-1 |
| id | 178a2ad5-f758-4af0-a920-1e54cc8260e5 |
| name | demo-1 |
| project_id | 45837e6267c44d7788a919d6e342e64c |
| revision_number | 1 |
| rules | created_at='2021-01-03T05:29:25Z', direction='egress', ethertype='IPv6', id='26d6494c-4bf5-44c1-91d4-0525c32046f5', updated_at='2021-01-03T05:29:25Z' |
| | created_at='2021-01-03T05:29:25Z', direction='egress', ethertype='IPv4', id='7a48bb5c-319d-4963-a7bc-406729e27a78', updated_at='2021-01-03T05:29:25Z' |
| stateful | True |
| tags | [] |
| updated_at | 2021-01-03T05:29:25Z |
+-----------------+-------------------------------------------------------------------------------------------------------------------------------------------------------+
iptables
Chain neutron-openvswi-i33d3e592-c
对应的 ipset NIPv4178a2ad5-f758-4af0-a920-
members 为空,安全组工作正常。
stack@xiexianbin-vm:~$ sudo iptables -nvL neutron-openvswi-i33d3e592-c
Chain neutron-openvswi-i33d3e592-c (1 references)
pkts bytes target prot opt in out source destination
5 420 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */
2 696 RETURN udp -- * * 0.0.0.0/0 10.0.0.29 udp spt:67 dpt:68
0 0 RETURN udp -- * * 0.0.0.0/0 255.255.255.255 udp spt:67 dpt:68
0 0 RETURN icmp -- * * 10.1.0.0/24 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 match-set NIPv4178a2ad5-f758-4af0-a920- src
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */
0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */
stack@xiexianbin-vm:~$ sudo ipset list NIPv4178a2ad5-f758-4af0-a920-
Name: NIPv4178a2ad5-f758-4af0-a920-
Type: hash:net
Revision: 6
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 448
References: 1
Number of entries: 0
Members:
https://www.xiexianbin.cn/openstack/neutron/2015-03-21-neutron-havana-allow-address-pairs/index.html