<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
%BOOK_ENTITIES;
]>
<!-- Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at
  http://www.apache.org/licenses/LICENSE-2.0
  Unless required by applicable law or agreed to in writing,
  software distributed under the License is distributed on an
  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, either express or implied.  See the License for the
  specific language governing permissions and limitations
  under the License.
-->
<section id="ip-forwarding-firewalling">
  <title>IP Forwarding and Firewalling</title>
  <para>By default, all incoming traffic to the public IP address is rejected.
    All outgoing traffic from the guests is also blocked by default.</para>
  <para>To allow outgoing traffic, follow the procedure in <xref linkend="egress-firewall-rule"/>.</para>
  <para>To allow incoming traffic, users may set up firewall rules and/or port forwarding rules. For
    example, you can use a firewall rule to open a range of ports on the public IP address, such as
    33 through 44. Then use port forwarding rules to direct traffic from individual ports within
    that range to specific ports on user VMs. For example, one port forwarding rule could route
    incoming traffic on the public IP's port 33 to port 100 on one user VM's private IP.</para>
  <xi:include href="egress-firewall-rule.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
  <xi:include href="firewall-rules.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
  <xi:include href="port-forwarding.xml" xmlns:xi="http://www.w3.org/2001/XInclude"/>
</section>