You should check to determine if the firewall is enabled. The output of the neutron ext-list should contain a firewall entry.

neutron ext-list

Assuming the external network is already created by the admin, this command will show the external network.

neutron net-list

Create the network, subnet and router.

neutron net-create private
neutron subnet-create --name sub private 10.0.0.0/24 --gateway 10.0.0.1
neutron router-create router
neutron router-interface-add router sub
neutron router-gateway-set router ext-net

Create security group rules. Security group rules filter traffic at VM level.

neutron security-group-rule-create default --protocol icmp
neutron security-group-rule-create default --protocol tcp --port-range-min 22 --port-range-max 22
neutron security-group-rule-create default --protocol tcp --port-range-min 80 --port-range-max 80

Boot a VM.

NET=$(neutron net-list | awk '/private/ {print $2}')
nova boot --flavor 1 --image <image> --nic net-id=$NET vm1 --poll

Verify if the instance is ACTIVE and is assigned an IP address.

nova list

Get the port id of the vm1 instance.

fixedip=$(nova list | awk '/vm1/ {print $12}' | awk -F '=' '{print $2}' | awk -F ',' '{print $1}')
vmportuuid=$(neutron port-list | grep $fixedip | awk '{print $2}')

Create and associate a floating IP address to the vm1 instance.

neutron floatingip-create ext-net --port-id $vmportuuid

Verify if the floating IP is assigned to the instance. The following command should show an assigned floating IP address from the external network range.

nova show vm1

Verify if the instance is reachable from the external network. SSH into the instance from a node in (or has route to) the external network.

ssh cirros@FIP-VM1
password: <password>

Create new firewall rules using firewall-rule-create command and providing the protocol, action (allow, deny, reject) and name for the new rule.

Firewall actions provide rules in which data traffic can be handled. An allow rule will allow traffic to pass through the firewall, deny will stop and prevent data traffic from passing through the firewall and reject will reject the data traffic and return a destination-unreachable response. Using reject will speed up failure detection time dramatically for legitimate users, since they will not be required to wait for retransmission timeouts or submit retries. Some customers should stick with deny where prevention of port scanners and similar methods may be attempted by hostile attackers. Using deny will drop all of the packets, making it more difficult for malicious intent. The firewall action, deny is the default behavior.

The example below demonstrates how to allow icmp and ssh while denying access to http. See the neutron command-line reference at http://docs.openstack.org/cli-reference/content/neutronclient_commands.html on additional options such as source IP, destination IP, source port and destination port.

Note

You can create a firewall rule with an identical name and each instance will have a unique id associated with the created rule, however for clarity purposes this is not recommended.

neutron firewall-rule-create --protocol icmp --action allow --name allow-icmp
neutron firewall-rule-create --protocol tcp --destination-port 80 --action deny --name deny-http
neutron firewall-rule-create --protocol tcp --destination-port 22 --action allow --name allow-ssh

Once the rules are created, create the firewall policy by using the firewall-policy-create command with the --firewall-rules option and rules to include in quotes, followed by the name of the new policy. The order of the rules is important.

neutron firewall-policy-create --firewall-rules "allow-icmp deny-http allow-ssh" policy-fw

Finish the firewall creation by using the firewall-create command, the policy name and the new name you want to give to your new firewall.

neutron firewall-create policy-fw --name user-fw

You can view the details of your new firewall by using the firewall-show command and the name of your firewall. This will verify that the status of the firewall is ACTIVE.

neutron firewall-show user-fw

Since allow-icmp firewall rule is set you can ping the floating IP address of the instance from the external network.

ping <FIP-VM1>

Similarly, you can connect via ssh to the instance due to the allow-ssh firewall rule.

ssh cirros@<FIP-VM1>
password: <password>

Run a web server on vm1 instance that listens over port 80, accepts requests and sends a WELCOME response.

$ vi webserv.sh

#!/bin/bash

MYIP=$(/sbin/ifconfig eth0|grep 'inet addr'|awk -F: '{print $2}'| awk '{print $1}');
while true; do
  echo -e "HTTP/1.0 200 OK

Welcome to $MYIP" | sudo nc -l -p 80
done

# Give it Exec rights
$ chmod 755 webserv.sh

# Execute the script
$ ./webserv.sh

You should expect to see curl fail over port 80 because of the deny-http firewall rule. If curl succeeds, the firewall is not blocking incoming http requests.

curl -vvv <FIP-VM1>