Firewall¶
Contents
The Virtual Machines -> Firewall section allows managing security groups that are used for isolating traffic to virtual machines. A security group is a group of VMs that filter their incoming and outgoing traffic according to a set of rules.
Read more about security groups in the official documentation of CloudStack.
In this UI section, a user can see and manage firewall templates, shared and private security groups.
Firewall templates are presets of rules that can be system or developed by a user (custom). Administrators can specify default presets during the interface deployment via the JSON configuration file (find more in configurations guide). These presets will be used when creating a new security group.
A custom security group template can be created via the UI. Find more information on how to create a custom security group template at Create a Security Group Template.
Upon VM creation, a user applies templates (if they exist) to create a new security group for a VM. These rules make a private security group used for that virtual machine only. Thus, when a user changes the rules for a certain virtual machine, it does not affect other machines.
The second way is to use a shared security group for your virtual machine. Shared groups are used by several VMs. Changes of rules in them may affect other VMs.
A default security group can be defined for the account. It will be preselected for each new virtual machine. Please, read the configuration guide to find more information on how to set up a default security group.
Users can manage security group rules in two modes: a “view” mode with filtering by types and protocols and an “edit” mode. Security groups editing is available when switching from “view” mode to “editing” mode. If the group is shared, the user is warned that changes will affect other VMs using this group. This behavior allows avoiding undesirable changes for other VMs.
Templates, shared and private security groups are placed in different tabs of the Firewall section. You can switch from templates to shared or private security groups using the tool above the list.
A user can see security groups of his/her user only. An Administrator can observe security groups of all accounts in the domain.
Firewall List¶
The security groups are presented in a list format. You can change the view from list to cards clicking the switch view icon / in the upper-right corner.
To quickly find the security group you need, please, use the search tool above the list. Enter a name or a part of the name of the template/security group and see the immediate result.
Administrators can filter the list of templates/shared groups by accounts.
Create a Security Group Template¶
You can create your own template. It will be available as a base at a new private security group creation for VM.
A new security group template is created on the base of existing templates. This security group will be created as a custom template (with a custom-template
type).
If you would like to create a new security group template, click “Create” in the bottom-right corner and fill in the form:
Note
Required fields are marked with an asterisk (*).
- Name * - Enter a name for the template.
- Description - Provide a short description for the firewall template.
- Basic rules - Click “ADD” to open the list of rules to assign them to the template. In the appeared window select a template in the “All templates” list at the left and move it to the “Selected templates” list at the right by clicking the arrow icon:
Click “SELECT ALL” to move all templates from left to right at once.
Click “RESET” to drop all selected templates.
In the list below you will see the rules corresponding to the selected templates. All of them are checked as selected. Uncheck those you do not wish to add to your firewall template.
Click “SAVE” to apply the selected rules to your security group template.
Click “CANCEL” to drop the selected options. No rules will be assigned to the template. You will return to the “Create a new security group” window.
When all fields are completed, click “CREATE” to create the new firewall template. The template will appear in the list of firewall templates as Custom:
Click “CANCEL” to cancel the template creation process. No firewall templates will be created then. All fields will be cleared in the form.
Private Security Groups¶
Private security groups are listed in the Private Security Groups section.
Security groups appear in this section once they are created for a virtual machine (see Create a Virtual Machine). A private security group name has the following format - sg-{{ virtual machine name }}
- containing the name of the virtual machine it is created for.
You can quickly find a group by its name or a part of the name using the searching tool above the list.
Besides, Administrators can filter the list by accounts.
You can filter the list by ticking the “Orphan” checkbox above. It allows displaying only the security groups that are not used by any machine.
The “Orphan” option appears above the list in case the security groups that are not used by any VM exist in the list. This might happen in case a VM has been deleted but a group has been not (because of an error or incorrect behavior).
Security Group Details Sidebar¶
You can see the firewall rules details in the sidebar to the right.
Click the template/shared/private security group in the list and open the sidebar. You will see two tabs there - Details and Tags.
The Details tab contains the following information:
- Name of the security group;
- Security Group Action Box under ;
- ID of the security group;
- Description giving an idea what the security group contains (not available for private security groups);
- Type - Defines the security group types. For firewall templates it can be
custom-template
for custom templates, orpredefined-template
for system templates. For shared security groups it isshared
. For private security groups you will seeprivate
.
For shared security groups you also can see what virtual machines are assigned to this group. The machine name in the list is active. You can move to the virtual machine details bar by clicking it.
For private security groups a VM name is also displayed in the details sidebar, but it is not active.
The Tags tab presents the list of tags assigned to the security group. Using the search tool above you can quickly find a tag by its name.
System tags are listed in a separate card.
Сlick to add a tag. Enter a key and a value.
Note
Both fields are required. The input values for both fields cannot start with a space.
Click “CREATE” to create the new tag. It will be saved in a separate card.
An existing tag can be edited or deleted by clicking a correspondent icon next to the tag’s name.
Security Group Action Box¶
Firewall templates, shared and private security groups have an Action box with the following actions in it:
- View - Allows viewing the rules in the group/template. Click “Rules” to open the rules implemented to the template.
- Delete - Allows deleting the group or the template from the system.
Note
A template/security group cannot be deleted if it is used for a virtual machine, or it belongs to another user. Deleting action is not available for system firewall templates.
Edit a Firewall Template/Security Group¶
When clicking “Rules” in the Action box you open a modal window where the rules of the template/security group are listed. The list of rules can be filtered by:
- IP versions - IPv4 and/or IPv6;
- Types - Ingress and/or Egress;
- Protocols - TCP and/or UDP and/or ICMP.
Besides, you can group the rules by types and/or protocols.
You can edit the implemented rules right in this modal window by clicking “EDIT” below the list. When switching to the edit mode you are enabled to add rules or delete the selected ones from the list.
To add rules, please, fill in the fields in the panel above the list and click “+”:
Validation
Please, make sure you enter valid values for Start and End ports:
- Start port can be less or equal to End port. For more convenience, we added the autocomplete, that is, when entering a Start port value, the End port field is prepopulated with an equal value.
- The values in these fields cannot be greater/less than maximum/minimum allowed values (for TCP/UDP max port is 65535, for ICMP - 255).
- The fields cannot be empty.
For ICMP type make sure you input a valid CIDR, ICMP type and code.
- You will not be able to enter an ICMP type and a code until a valid CIDR is specified. Likewise, you will not be able to enter an ICMP code until a valid ICMP type is specified.
- CIDR allows entering IP addresses in both IPv4 and IPv6 formats.
- ICMP IPv6 the “[-1] Any” value is supported for type and code.
- ICMP type and code fields cannot be empty.
For invalid values the add button “+” is disabled.
To delete rules, please, click the Delete icon in the list. The rule will be deleted from the security group.
Then you can move back to the view mode, or close the window. You will see the rules are edited.
Please, note, when editing shared security groups, a warning message appears:
Click “Yes” if you still want to edit a shared security group. You will be switched to the “Edit” mode. Change the security group as you need following the instructions above.
Note
Editing is not available for system firewall templates and security groups of other users. You can view the rules only.