{"action":"created","issue":{"url":"https://api.github.com/repos/apache/cloudstack/issues/765","labels_url":"https://api.github.com/repos/apache/cloudstack/issues/765/labels{/name}","comments_url":"https://api.github.com/repos/apache/cloudstack/issues/765/comments","events_url":"https://api.github.com/repos/apache/cloudstack/issues/765/events","html_url":"https://github.com/apache/cloudstack/pull/765","id":104042222,"number":765,"title":"CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be se…","user":{"login":"wilderrodrigues","id":5129209,"avatar_url":"https://avatars.githubusercontent.com/u/5129209?v=3","gravatar_id":"","url":"https://api.github.com/users/wilderrodrigues","html_url":"https://github.com/wilderrodrigues","followers_url":"https://api.github.com/users/wilderrodrigues/followers","following_url":"https://api.github.com/users/wilderrodrigues/following{/other_user}","gists_url":"https://api.github.com/users/wilderrodrigues/gists{/gist_id}","starred_url":"https://api.github.com/users/wilderrodrigues/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilderrodrigues/subscriptions","organizations_url":"https://api.github.com/users/wilderrodrigues/orgs","repos_url":"https://api.github.com/users/wilderrodrigues/repos","events_url":"https://api.github.com/users/wilderrodrigues/events{/privacy}","received_events_url":"https://api.github.com/users/wilderrodrigues/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":59,"created_at":"2015-08-31T12:12:35Z","updated_at":"2015-09-07T15:26:28Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/cloudstack/pulls/765","html_url":"https://github.com/apache/cloudstack/pull/765","diff_url":"https://github.com/apache/cloudstack/pull/765.diff","patch_url":"https://github.com/apache/cloudstack/pull/765.patch"},"body":"…t to DROP instead of ACCEPT\r\n\r\n  - In order to be able to access the routers via the link local interface, we have to add a rules with NEW and ESTABLISHED state\r\n\r\nTests:\r\n\r\n* Deployed 2 zones, basic and advanced, using KVM as hypervisor\r\n* On the basic zone, created 1 security group, added ingress rules to open port 22 and deployed 1 VM\r\n  * SSH into the router and checked that the INPUT/FORWARD policies were set to DROP\r\n  * SSH to the VM\r\n* On the advanced zone, created 1 single VPC (with 2 tiers, 2 puc IPs, 2 VMs and 1 ACL), 1 redundant VPC ((with 2 tiers, 2 puc IPs, 2 VMs and 1 ACL)), 1 isolated network (with 1 VM and 1 pub IP), 1 redundant network (with 1 VM and 1 pub IP)\r\n  * SSH into all routers to check that the INPUT/FORWARD policies were set to DROP\r\n  * SSH into all VMs to test the communication\r\n\r\n ``` \r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.26\r\nThe authenticity of host '192.168.23.26 (192.168.23.26)' can't be established.\r\nRSA key fingerprint is cb:42:81:d0:05:97:f4:be:9e:3b:dd:3f:c6:d2:48:e7.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.23.26' (RSA) to the list of known hosts.\r\nroot@192.168.23.26's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exit\r\nConnection to 192.168.23.26 closed.\r\n\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.22.63\r\nThe authenticity of host '192.168.22.63 (192.168.22.63)' can't be established.\r\nRSA key fingerprint is a2:20:d6:e2:fb:c5:89:94:57:f5:89:b1:a1:6d:63:99.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.22.63' (RSA) to the list of known hosts.\r\nroot@192.168.22.63's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exit\r\nConnection to 192.168.22.63 closed.\r\n\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.27 \r\nThe authenticity of host '192.168.23.27 (192.168.23.27)' can't be established.\r\nRSA key fingerprint is 20:f1:6d:9b:74:c5:7b:53:10:5c:a0:0c:bc:9f:2a:29.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.23.27' (RSA) to the list of known hosts.\r\nroot@192.168.23.27's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exitConnection to 192.168.23.27 closed.\r\n\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.28\r\nThe authenticity of host '192.168.23.28 (192.168.23.28)' can't be established.\r\nRSA key fingerprint is f7:ae:49:46:ba:02:c1:25:5a:50:87:0e:6f:a4:43:a3.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.23.28' (RSA) to the list of known hosts.\r\nroot@192.168.23.28's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exitConnection to 192.168.23.28 closed.\r\n\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.29\r\nThe authenticity of host '192.168.23.29 (192.168.23.29)' can't be established.\r\nRSA key fingerprint is 09:0c:f2:41:a3:74:3d:ee:04:2b:78:ff:a9:91:0d:79.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.23.29' (RSA) to the list of known hosts.\r\nroot@192.168.23.29's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exit\r\nConnection to 192.168.23.29 closed.\r\n\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.30\r\nThe authenticity of host '192.168.23.30 (192.168.23.30)' can't be established.\r\nRSA key fingerprint is 2c:a6:10:f5:6d:4b:d1:70:e2:47:07:19:0b:86:c1:b0.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.23.30' (RSA) to the list of known hosts.\r\nroot@192.168.23.30's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exitConnection to 192.168.23.30 closed.\r\n\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.32\r\nThe authenticity of host '192.168.23.32 (192.168.23.32)' can't be established.\r\nRSA key fingerprint is 6b:85:1e:c7:2e:aa:01:a2:d4:19:e3:ec:a7:69:a1:71.\r\nAre you sure you want to continue connecting (yes/no)? yes\r\nWarning: Permanently added '192.168.23.32' (RSA) to the list of known hosts.\r\nroot@192.168.23.32's password: \r\n# ls /\r\nbin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var\r\n# exitConnection to 192.168.23.32 closed.\r\nsbpltk1zffh04:asf_cloudstack wrodrigues$ \r\n ``` \r\n\r\nI'm now running some automated tests, will post the results here once they are complete.\r\n\r\n@remibergsma @DaanHoogland @bhaisaab @miguelaferreira @wido @karuturi , could you guys please have a look?\r\n\r\nDo not forget to replace the systemvm.iso in your hypervisor. Do the following for KVM:\r\n\r\n* Copy this:\r\n  * ./client/target/cloud-client-ui-4.6.0-SNAPSHOT/WEB-INF/classes/vms/systemvm.iso\r\n* To:\r\n  *  /usr/share/cloudstack-common/vms/systemvm.iso\r\n\r\nCheers,\r\nWilder\r\n"},"comment":{"url":"https://api.github.com/repos/apache/cloudstack/issues/comments/138325171","html_url":"https://github.com/apache/cloudstack/pull/765#issuecomment-138325171","issue_url":"https://api.github.com/repos/apache/cloudstack/issues/765","id":138325171,"user":{"login":"asfbot","id":5243949,"avatar_url":"https://avatars.githubusercontent.com/u/5243949?v=3","gravatar_id":"","url":"https://api.github.com/users/asfbot","html_url":"https://github.com/asfbot","followers_url":"https://api.github.com/users/asfbot/followers","following_url":"https://api.github.com/users/asfbot/following{/other_user}","gists_url":"https://api.github.com/users/asfbot/gists{/gist_id}","starred_url":"https://api.github.com/users/asfbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asfbot/subscriptions","organizations_url":"https://api.github.com/users/asfbot/orgs","repos_url":"https://api.github.com/users/asfbot/repos","events_url":"https://api.github.com/users/asfbot/events{/privacy}","received_events_url":"https://api.github.com/users/asfbot/received_events","type":"User","site_admin":false},"created_at":"2015-09-07T15:26:28Z","updated_at":"2015-09-07T15:26:28Z","body":"[cloudstack-pull-rats #538](https://builds.apache.org/job/cloudstack-pull-rats/538/) SUCCESS\nThis pull request looks good"}}