Hi,<div><br></div><div>It is easy to mimic the EC2 security groups in OpenNebula. As said before in this thread, OpenNebula can be adapted to your network architecture. I'll give you a couple of hints here and let us know if you need more help:</div>
<div><br></div><div><ul><li>Let assume that your VMs are connected to the Internet through a predefined <b>network</b> named <b>"Public". </b>The network is defined as usual in OpenNebula.</li><li>VMs attached to this network do have access to the Internet and are given a public IP. Let's assume that you palce a VM in that network and only connections to TCP ports 22 and 80 are allowed. The <b>VM template</b> to get a lease from that network could be</li>
</ul></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font face="'courier new', monospace">...</font></div></div><div><div>
<font face="'courier new', monospace">NIC = [ NETWORK = "Public", IN_TCP_PORTS = "22 80" ]</font></div></div><div><div><font face="'courier new', monospace">...</font></div>
</div></blockquote><div><div><ul><li>Now you have to configure a hook that automatically set an iptables rule for the VM interface attached to the bridge used by that network (we are setting the firewall from the outside). You have to pass the ports you want to open, the <b>hook in oned.conf</b> would be:</li>
</ul></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><div><div><font face="'courier new', monospace">...</font></div>
</div></div></div><div><div><div><div><font face="'courier new', monospace"><div>VM_HOOK = [</div><div> name = "myiptables",</div><div> on = "running",</div>
<div> command = "/srv/cloud/one/share/hooks/myiptables",</div><div> arguments = '$NIC[IN_TCP_PORTS, Network = "Public"]',</div><div> remote = "yes" ]</div></font></div>
</div>
</div></div><div><div><div><div><font face="'courier new', monospace">...</font></div></div></div></div></blockquote><div><div><ul><li>You have to <b>develop the myiptables</b> scripts and should be placed in your hosts in the cluster, (the remotes location is a good place). You can use the $ONE_LOCATION/share/hooks/ebtables script as an starting point. You have xen and kvm versions.</li>
<li><b>Final touches</b>, you may need some configurations: the hooks are executed by oneadmin so you may need to grant access oneadmin to some network utils in the /etc/sudoers file. Also you probably want to remove the rules when the VM is shutdown, there is also and ebtables_flush script that you can use as inspiration to create other VM hook. Take a look to the Network guide to get an idea of the overall process [1],</li>
</ul></div><div>
Also you can do this through the CONTEXT section. In this case the firewall is set from the inside. Drawbacks are: solution is OS specific and firewall rules can be bypassed (either intentionally or not). In this case you have to create an script that creates the firewall configuration of the VM. Setting the specific ports in a VM template could look like:</div>
<div><br></div><div>CONTEXT = [ IN_TCP_PORTS = "22 80" ]</div><div><br></div><div>But this is just the easy part, you have to prepare the context scripts to deal with the OUT_TCP_PORTS variable [1]</div><div> </div>
Just a final thought, Eucalyptus and maybe others provide this out-of-the-box but the price of this is too high, IMHO. OpenNebula does not require any specific network setup in your hosts, and it gives you more flexibility (i.e. multiple NICs on a VM attached to different networks). Trying to cover as much hw configurations as possible prevents some straight-forward configurations. Nevertheless balance is always a desirable state, Do you think that we should include this in the distro + documentation?</div>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div><br></div><div>Cheers</div><div><br></div><div>Ruben</div><div><br></div><div><div class="gmail_quote">REFERENCES</div><div class="gmail_quote">[1] <a href="http://www.opennebula.org/documentation:rel2.0:nm">http://www.opennebula.org/documentation:rel2.0:nm</a></div>
<div class="gmail_quote">[2] <a href="http://www.opennebula.org/documentation:rel2.0:cong" target="_blank">http://www.opennebula.org/documentation:rel2.0:cong</a></div>
<div class="gmail_quote"><br></div><div class="gmail_quote"><br></div><div class="gmail_quote">On Tue, Feb 1, 2011 at 8:12 PM, Toens Bueker <span dir="ltr"><<a href="mailto:toens.bueker@lists0903.nurfuerspam.neuroserve.de" target="_blank">toens.bueker@lists0903.nurfuerspam.neuroserve.de</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Zeeshan Ali Shah <<a href="mailto:zashah@pdc.kth.se" target="_blank">zashah@pdc.kth.se</a>> wrote:<br>
<br>
</div><div>> No Firewall yet , that is i am asking how to put mechanism like<br>
> Security Group of amazon . preferably with out any HW (if possible)<br>
<br>
</div>OpenNebulas components allow you to implement and manage virtual<br>
networks on physical infrastructure.<br>
<br>
I'm not really sure where a "NATing device" should be implemented. As<br>
you use the Xen hypervisor you could implement routed (not bridged)<br>
network interfaces.<br>
<br>
But that is not an issue, which would be solved in a management<br>
software component like OpenNebula (as there are so many possibilities<br>
to implement such a solution).<br>
<br>
If you have a solution for your problem, I'm sure it should be<br>
possible to adapt OpenNebula to it.<br>
<div><br>
Regards,<br>
Töns<br>
--<br>
There is no safe distance.<br>
_______________________________________________<br>
</div><div><div></div><div>Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Dr. Ruben Santiago Montero<br>Associate Professor (Profesor Titular), Complutense University of Madrid<br><br>URL: <a href="http://dsa-research.org/doku.php?id=people:ruben" target="_blank">http://dsa-research.org/doku.php?id=people:ruben</a><br>
Weblog: <a href="http://blog.dsa-research.org/?author=7" target="_blank">http://blog.dsa-research.org/?author=7</a><br>
</div>