Do you want to protect the VMs or the manager? ----- Original Message ----- From: "Ovirt User" <ldrt8789(a)gmail.com&gt; To: users(a)ovirt.org Sent: Tuesday, June 3, 2014 11:29:23 AM Subject: [ovirt-users] Firewall? Hello Guys, i'm searching for a simple firewall solution ( deny some ports etc ). It is possibile configure a firewall in the node ? to protect the vm's ? Thanks Lukas _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

The VM becomes its own system, you will have to enable the firewall on the VM itself. Windows Firewall for Windows clients and Iptables or Firewalld for Linux clients ----- Original Message ----- From: "Ovirt User" <ldrt8789(a)gmail.com&gt; To: "Maurice James" <mjames(a)media-node.com&gt; Cc: users(a)ovirt.org Sent: Tuesday, June 3, 2014 3:33:10 PM Subject: Re: [ovirt-users] Firewall? the vm's thanks Il giorno 03/giu/2014, alle ore 17:39, Maurice James <mjames(a)media-node.com&gt; ha scritto: > Do you want to protect the VMs or the manager? > > > ----- Original Message ----- > From: "Ovirt User" <ldrt8789(a)gmail.com&gt; > To: users(a)ovirt.org > Sent: Tuesday, June 3, 2014 11:29:23 AM > Subject: [ovirt-users] Firewall? > > Hello Guys, > > i'm searching for a simple firewall solution ( deny some ports etc ). > > It is possibile configure a firewall in the node ? to protect the vm's ? > > Thanks > Lukas > > > > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users

On 06/04/2014 04:08 PM, Maurice James wrote: > As far as I know the node cannot manage the firewall on the VM, just like the node cannot manage the firewall of another node try the Security Groups support in 3.4 via the neutron integration? http://www.ovirt.org/Features/Detailed_OSN_Integration > > ----- Original Message ----- > From: "Ovirt User" <ldrt8789(a)gmail.com&gt; > To: "Maurice James" <mjames(a)media-node.com&gt; > Cc: users(a)ovirt.org > Sent: Wednesday, June 4, 2014 1:48:13 AM > Subject: Re: [ovirt-users] Firewall? > > thanks i know that. :) > > i'm asking if it is possible manage firewall rules at node level , since node manage networking for VM'S… > > anyone know that ? > > thanks > > Il giorno 04/giu/2014, alle ore 01:15, Maurice James <mjames(a)media-node.com&gt; ha scritto: > >> The VM becomes its own system, you will have to enable the firewall on the VM itself. Windows Firewall for Windows clients and Iptables or Firewalld for Linux clients >> >> >> ----- Original Message ----- >> From: "Ovirt User" <ldrt8789(a)gmail.com&gt; >> To: "Maurice James" <mjames(a)media-node.com&gt; >> Cc: users(a)ovirt.org >> Sent: Tuesday, June 3, 2014 3:33:10 PM >> Subject: Re: [ovirt-users] Firewall? >> >> the vm's >> >> thanks >> >> >> Il giorno 03/giu/2014, alle ore 17:39, Maurice James <mjames(a)media-node.com&gt; ha scritto: >> >>> Do you want to protect the VMs or the manager? >>> >>> >>> ----- Original Message ----- >>> From: "Ovirt User" <ldrt8789(a)gmail.com&gt; >>> To: users(a)ovirt.org >>> Sent: Tuesday, June 3, 2014 11:29:23 AM >>> Subject: [ovirt-users] Firewall? >>> >>> Hello Guys, >>> >>> i'm searching for a simple firewall solution ( deny some ports etc ). >>> >>> It is possibile configure a firewall in the node ? to protect the vm's ? >>> >>> Thanks >>> Lukas >>> >>> >>> >>> _______________________________________________ >>> Users mailing list >>> Users(a)ovirt.org >>> http://lists.ovirt.org/mailman/listinfo/users >> > > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users >

yes i know neutron, but really i don't want a server manage my L3 networks ! :-) :-)) and you ? Il giorno 04/giu/2014, alle ore 22:15, Itamar Heim <iheim(a)redhat.com&gt; ha scritto: > On 06/04/2014 04:08 PM, Maurice James wrote: >> As far as I know the node cannot manage the firewall on the VM, just like the node cannot manage the firewall of another node > try the Security Groups support in 3.4 via the neutron integration? > http://www.ovirt.org/Features/Detailed_OSN_Integration > >> ----- Original Message ----- >> From: "Ovirt User" <ldrt8789(a)gmail.com&gt; >> To: "Maurice James" <mjames(a)media-node.com&gt; >> Cc: users(a)ovirt.org >> Sent: Wednesday, June 4, 2014 1:48:13 AM >> Subject: Re: [ovirt-users] Firewall? >> >> thanks i know that. :) >> >> i'm asking if it is possible manage firewall rules at node level , since node manage networking for VM'S… >> >> anyone know that ? >> >> thanks >> >> Il giorno 04/giu/2014, alle ore 01:15, Maurice James <mjames(a)media-node.com&gt; ha scritto: >> >>> The VM becomes its own system, you will have to enable the firewall on the VM itself. Windows Firewall for Windows clients and Iptables or Firewalld for Linux clients >>> >>> >>> ----- Original Message ----- >>> From: "Ovirt User" <ldrt8789(a)gmail.com&gt; >>> To: "Maurice James" <mjames(a)media-node.com&gt; >>> Cc: users(a)ovirt.org >>> Sent: Tuesday, June 3, 2014 3:33:10 PM >>> Subject: Re: [ovirt-users] Firewall? >>> >>> the vm's >>> >>> thanks >>> >>> >>> Il giorno 03/giu/2014, alle ore 17:39, Maurice James <mjames(a)media-node.com&gt; ha scritto: >>> >>>> Do you want to protect the VMs or the manager? >>>> >>>> >>>> ----- Original Message ----- >>>> From: "Ovirt User" <ldrt8789(a)gmail.com&gt; >>>> To: users(a)ovirt.org >>>> Sent: Tuesday, June 3, 2014 11:29:23 AM >>>> Subject: [ovirt-users] Firewall? >>>> >>>> Hello Guys, >>>> >>>> i'm searching for a simple firewall solution ( deny some ports etc ). >>>> >>>> It is possibile configure a firewall in the node ? to protect the vm's ? >>>> >>>> Thanks >>>> Lukas >>>> >>>> >>>> >>>> _______________________________________________ >>>> Users mailing list >>>> Users(a)ovirt.org >>>> http://lists.ovirt.org/mailman/listinfo/users >> _______________________________________________ >> Users mailing list >> Users(a)ovirt.org >> http://lists.ovirt.org/mailman/listinfo/users >> _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

Thanks livnat, but i don't really understand . The security group feature defines iptables rules on the note itself. About that: how can i define security group rules ? and in a cluster, they are automatically propagated al all nodes ?

From the user perspective you need to configure a security group policy

Il giorno 03/giu/2014, alle ore 17:29, Ovirt User <ldrt8789(a)gmail.com&gt; ha scritto: > Hello Guys, > > i'm searching for a simple firewall solution ( deny some ports etc ). > > It is possibile configure a firewall in the node ? to protect the vm's ? > > Thanks > Lukas > > > _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

On Thu, Jun 5, 2014 at 10:02 AM, Livnat Peer <lpeer(a)redhat.com <mailto:lpeer@redhat.com>> wrote: [snip] The security group is configured per VM, the rules are configured by the system on the node the VM is running on. From the user perspective you need to configure a security group policy and then associate the VM with the relevant policy, there is also a default policy to which all VMs are associated by default. To use this feature you need to use the oVirt-Neutron integration - http://www.ovirt.org/Features/Detailed_OSN_Integration#Security_groups How can I set more than one custom device property? For example in my case when I had to use extnet I lose the security groups one... before [root@tekkaman ovirt-engine]# engine-config -g CustomDeviceProperties CustomDeviceProperties: version: 3.0 CustomDeviceProperties: version: 3.1 CustomDeviceProperties: version: 3.2 CustomDeviceProperties: version: 3.3 CustomDeviceProperties: {type=interface;prop={SecurityGroups=^(?:(?:[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, *)*[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}|)$}} version: 3.4 then [root@tekkaman ovirt-engine]# engine-config -s CustomDeviceProperties='{type=interface;prop={extnet=^[a-zA-Z0-9_ ---]+$}}' Please select a version: 1. 3.0 2. 3.1 3. 3.2 4. 3.3 5. 3.4 5 after: [root@tekkaman ovirt-engine]# engine-config -g CustomDeviceProperties CustomDeviceProperties: version: 3.0 CustomDeviceProperties: version: 3.1 CustomDeviceProperties: version: 3.2 CustomDeviceProperties: version: 3.3 CustomDeviceProperties: {type=interface;prop={extnet=^[a-zA-Z0-9_ ---]+$}} version: 3.4 # systemctl restart ovirt-engine What is the syntax to add extnet without deleting security groups one? Thanks Gianluca

Hello Guys, i'm searching for a simple firewall solution ( deny some ports etc ). It is possibile configure a firewall in the node ? to protect the vm's ? Thanks Lukas