docs/en-US/firewall-rules.xml

<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
<!ENTITY % BOOK_ENTITIES SYSTEM "cloudstack.ent">
%BOOK_ENTITIES;
]>
<!-- Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at
  http://www.apache.org/licenses/LICENSE-2.0
  Unless required by applicable law or agreed to in writing,
  software distributed under the License is distributed on an
  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, either express or implied.  See the License for the
  specific language governing permissions and limitations
  under the License.
-->
<section id="firewall-rules">
  <title>Firewall Rules</title>
  <para>By default, all incoming traffic to the public IP address is rejected by the firewall. To
    allow external traffic, you can open firewall ports by specifying firewall rules. You can
    optionally specify one or more CIDRs to filter the source IPs. This is useful when you want to
    allow only incoming requests from certain IP addresses.</para>
  <para>You cannot use firewall rules to open ports for an elastic IP address. When elastic IP is
    used, outside access is instead controlled through the use of security groups. See <xref
      linkend="add-security-group"/>.</para>
  <para>In an advanced zone, you can also create egress firewall rules by using the virtual router.
    For more information, see <xref linkend="egress-firewall-rule"/>.</para>
  <para>Firewall rules can be created using the Firewall tab in the Management Server UI. This tab
    is not displayed by default when &PRODUCT; is installed. To display the Firewall tab, the
    &PRODUCT; administrator must set the global configuration parameter firewall.rule.ui.enabled to
    "true."</para>
  <para>To create a firewall rule:</para>
  <orderedlist>
    <listitem>
      <para>Log in to the &PRODUCT; UI as an administrator or end user. </para>
    </listitem>
    <listitem>
      <para>In the left navigation, choose Network.</para>
    </listitem>
    <listitem>
      <para>Click the name of the network where you want to work with.</para>
    </listitem>
    <listitem>
      <para>Click View IP Addresses.</para>
    </listitem>
    <listitem>
      <para>Click the IP address you want to work with.</para>
    </listitem>
    <listitem>
      <para>Click the Configuration tab and fill in the following values.</para>
      <itemizedlist>
        <listitem>
          <para><emphasis role="bold">Source CIDR</emphasis>. (Optional) To accept only traffic from
            IP addresses within a particular address block, enter a CIDR or a comma-separated list
            of CIDRs. Example: 192.168.0.0/22. Leave empty to allow all CIDRs.</para>
        </listitem>
        <listitem>
          <para><emphasis role="bold">Protocol</emphasis>. The communication protocol in use on the
            opened port(s).</para>
        </listitem>
        <listitem>
          <para><emphasis role="bold">Start Port and End Port</emphasis>. The port(s) you want to
            open on the firewall. If you are opening a single port, use the same number in both
            fields</para>
        </listitem>
        <listitem>
          <para><emphasis role="bold">ICMP Type and ICMP Code</emphasis>. Used only if Protocol is
            set to ICMP. Provide the type and code required by the ICMP protocol to fill out the
            ICMP header. Refer to ICMP documentation for more details if you are not sure what to
            enter</para>
        </listitem>
      </itemizedlist>
    </listitem>
    <listitem>
      <para>Click Add.</para>
    </listitem>
  </orderedlist>
</section>