The nova.virt.libvirt.firewall Module

class IptablesFirewallDriver(execute=None, **kwargs)

Bases: nova.virt.firewall.IptablesFirewallDriver

apply_instance_filter(instance, network_info)

No-op. Everything is done in prepare_instance_filter

instance_filter_exists(instance, network_info)

Check nova-instance-instance-xxx exists

setup_basic_filtering(instance, network_info)

Set up provider rules and basic NWFilter.

unfilter_instance(instance, network_info)
class NWFilterFirewall(get_connection, **kwargs)

Bases: nova.virt.firewall.FirewallDriver

This class implements a network filtering mechanism by using libvirt’s nwfilter. all instances get a filter (“nova-base”) applied. This filter provides some basic security such as protection against MAC spoofing, IP spoofing, and ARP spoofing.

apply_instance_filter(instance, network_info)

No-op. Everything is done in prepare_instance_filter

instance_filter_exists(instance, network_info)

Check nova-instance-instance-xxx exists

static nova_dhcp_filter()

The standard allow-dhcp-server filter is an <ip> one, so it uses ebtables to allow traffic through. Without a corresponding rule in iptables, it’ll get blocked anyway.

setup_basic_filtering(instance, network_info)

Set up basic filtering (MAC, IP, and ARP spoofing protection)

unfilter_instance(instance, network_info)

Clear out the nwfilter rules.

Previous topic

The nova.virt.libvirt.driver Module

Next topic

The nova.virt.libvirt.imagebackend Module

This Page