VMs with security groups allowing all egress traffic cannot access the Internet in 4.23.0.0
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- java
- Domain
- cloud, networking, security
Research direction
No files, tests, or entry points are identified. First reproduce the 4.23.0.0 case with an egress-only security group allowing 0.0.0.0/0, then compare it with an older working version and trace the security-group egress path. Done means the VM can initiate Internet connections with no ingress rules and the relevant regression is covered by a test.
Written by the indexing model from the issue text.
Description
problem
Description
In CloudStack 4.23.0.0, a VM cannot access the Internet when its security group has egress rules configured, even when the egress rules allow all outbound traffic (0.0.0.0/0).
The same configuration works as expected in older CloudStack versions.
The issue occurs when the security group has egress rules but no ingress rules.
Expected behavior
The VM should be able to initiate outbound connections to the Internet when the security group has an egress rule allowing all traffic.
According to the CloudStack documentation:
If there is no Egress rule in a Security Group, all the outgoing traffic will be allowed.
If there are Egress rules in a Security Group, only the outgoing traffic which match a Egress rule will be allowed.
Only the incoming traffic which match a Ingress rule will be allowed.
Actual behavior
With CloudStack 4.23.0.0:
- The VM has a security group assigned.
- The security group has one egress rule allowing ALL outbound traffic.
- There are no ingress rules.
- The VM cannot access the Internet.
versions
The versions of ACS, hypervisors, storage, network etc..
The steps to reproduce the bug
...
What to do about it?
No response
- Dominant language
- Java
- Stars
- 3.1k
- Forks
- 1.4k
- Avg merge
- 6d 20h
- Merged PRs (30d)
- 27
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/cloudstack
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/cloudstack#14222 ·
-
bug component:kubernetes
Difficulty 1/5 Under an hour Newbie friendliness 88/100
apache/cloudstack#14180 ·
-
bug component:projects component:UI
Difficulty 1/5 Under an hour Newbie friendliness 88/100
apache/cloudstack#14070 · 5 comments ·
-
component:backup
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/cloudstack#14013 ·
-
KVM agent fails to connect to Ceph RBD storage pool after upgrading Ceph client to Tentacle 20.2.4 Openbug component:ceph
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/cloudstack#13989 · 3 comments ·
All issues in apache/cloudstack
Similar issues
-
area/plugin
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
kestra-io/plugin-kestra#190 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
google-ai-edge/LiteRT-LM#3739 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
integra-team-red/meet-map#249 ·
-
[Studio][Bug] Cancelled create-user dialog keeps the password and admin switch for the next attempt Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
apache/rocketmq-dashboard#5064 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
wso2/dpdp-accelerator#287 ·