Firewall-as-a-Service (FWaaS) v1 scenario¶

Enable the FWaaS plug-in in the /etc/neutron/neutron.conf file:

service_plugins = firewall

[service_providers]
# ...
service_provider = FIREWALL:Iptables:neutron.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver:default

[fwaas]
driver = iptables
enabled = True

Configure the FWaaS plugin for the L3 agent.

In the AGENT section of l3_agent.ini, make sure the FWaaS extension is loaded:

[AGENT]
extensions = fwaas

Edit the FWaaS section in the /etc/neutron/neutron.conf file to indicate the agent version and driver:

[fwaas]
agent_version = v1
driver = iptables
enabled = True
conntrack_driver = conntrack

Create the required tables in the database:

# neutron-db-manage --subproject neutron-fwaas upgrade head

Enable the option in the local_settings.py file, which is typically located on the controller node:

OPENSTACK_NEUTRON_NETWORK = {
    # ...
    'enable_firewall' = True,
    # ...
}

Apply the settings by restarting the web server.

Restart the neutron-l3-agent and neutron-server services to apply the settings.

Create a firewall rule:

$ neutron firewall-rule-create --protocol {tcp,udp,icmp,any} \
  --source-ip-address SOURCE_IP_ADDRESS \
  --destination-ip-address DESTINATION_IP_ADDRESS \
  --source-port SOURCE_PORT_RANGE --destination-port DEST_PORT_RANGE \
  --action {allow,deny,reject}

The Networking client requires a protocol value. If the rule is protocol agnostic, you can use the any value.

Create a firewall policy:

$ neutron firewall-policy-create --firewall-rules \
  "FIREWALL_RULE_IDS_OR_NAMES" myfirewallpolicy

Separate firewall rule IDs or names with spaces. The order in which you specify the rules is important.

You can create a firewall policy without any rules and add rules later, as follows:

• To add multiple rules, use the update operation.
• To add a single rule, use the insert-rule operation.

For more details, see Networking command-line client in the OpenStack Command-Line Interface Reference.

Create a firewall:

$ neutron firewall-create FIREWALL_POLICY_UUID