private gateway ACLs are not applied correctly

[weizhouapache]

Steps to reproduce the issue

• add a vpc
• add a vpc tier and deploy a vm
• add a private gateway with ACL default_deny

expected:

• vm to private gw is blocked
• private gw to vm is blocked

actual:

• vm to private gw is allowed
• private gw to vm is blocked

ISSUE TYPE

• Bug Report

COMPONENT NAME

VPC VR

CLOUDSTACK VERSION

4.19

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

STEPS TO REPRODUCE

EXPECTED RESULTS

ACTUAL RESULTS

[weizhouapache]

it looks the issue is because of the order of rules

root@r-10-VM:~#iptables-save |grep FORWARD
:FORWARD ACCEPT [97:8028]
-A FORWARD -j VPN_STATS_eth1
-A FORWARD -j VPN_STATS_eth2
:FORWARD DROP [95:7876]
-A FORWARD -j NETWORK_STATS_eth2
-A FORWARD -j NETWORK_STATS_eth1
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 172.18.0.0/20 ! -d 172.18.0.0/20 -j ACCEPT
-A FORWARD -d 10.200.0.0/24 -o eth2 -j ACL_INBOUND_eth2
-A FORWARD -d 172.18.1.0/24 -o eth3 -j ACL_INBOUND_eth3

because of

-A FORWARD -s 172.18.0.0/20 ! -d 172.18.0.0/20 -j ACCEPT

the packet from vm to private gateway is accepted, so that the next rule becomes useless

-A FORWARD -d 10.200.0.0/24 -o eth2 -j ACL_INBOUND_eth2