Support firewall rules on Public IP in VPC

[btzq]

ISSUE TYPE

• Improvement Request

COMPONENT NAME

Improvement Request (UI, Functionality)

CLOUDSTACK VERSION

4.19

CONFIGURATION

N/A

OS / ENVIRONMENT

N/A

SUMMARY

Note: This ticket is broken down as requested from the origianl post, #8841

Support ACL on Public IP

• According to Terraform docs, it seems that this is possible: https://registry.terraform.io/providers/cloudstack/cloudstack/latest/docs/resources/firewall
• However, i cant seem to find this in the GUI. So in case this is not available in the GUI, would like to request to make this available.

STEPS TO REPRODUCE

N/A

N/A

EXPECTED RESULTS

To be able to manage ACL Rules more easily for large scale projects

ACTUAL RESULTS

Challenging to use ACL rules for large scale projects.

[DaanHoogland]

@btzq , if we implement #8864 , the firewall functionality will be supported by virtue of the private IPs. The user facing functionality will be somewhat different but the security features will be the same. A user wanting to set access lists into a VPC will have to know about its topology anyway. What do you think?

[btzq]

@DaanHoogland when you mean topopology, do you mean that the users will need to know the existance of a the Virtual Router?

[DaanHoogland]

@DaanHoogland when you mean topopology, do you mean that the users will need to know the existance of a the Virtual Router?

yes, but mostly the mapping of private IPs to static NAT Ips and individual services mapped from other IPs to the backends.
bad example:
public 10.10.10.10 - source NAT
public 10.10.10.11 - static NAT to private 10.11.12.10
public 10.10.10.12 - port 80 loadbalanced over 10.11.13.10 and 10.11.13.11
etc.

[btzq]

Hmm this is my opinion but i think part of the beauty of having cloud is that the customer does not need to know the topology of the underlying cloud service/infra. If the customer needs to learnt he existance of a router, it might complicate things for them and deter them from using the service.