Security Groups

1. 載入用戶 demo 環境變變數。

   [root@controller ~]# . demo.token
   

2. 列出 security group，只有 default 一項。

   [root@controller ~]# openstack security group list
   +--------------------------------------+---------+------------------------+----------------------------------+
   | ID                                   | Name    | Description            | Project                          |
   +--------------------------------------+---------+------------------------+----------------------------------+
   | 1f149288-87c2-43b5-a3b3-89eb153c9249 | default | Default security group | 92d1ec3e04384ad599c1a8f5aed73663 |
   +--------------------------------------+---------+------------------------+----------------------------------+
   

3. 列出 default 的 security group rule。

   [root@controller ~]# openstack security group rule list default
   +--------------------------------------+-------------+-----------+------------+-----------------------+
   | ID                                   | IP Protocol | IP Range  | Port Range | Remote Security Group |
   +--------------------------------------+-------------+-----------+------------+-----------------------+
   | 0e52cde4-637b-4c35-be1e-cc1b4a1c0518 | icmp        | 0.0.0.0/0 |            | None                  |
   | bc34846d-4398-4c7c-a250-33d37f363242 | tcp         | 0.0.0.0/0 | 22:22      | None                  |
   | da8408df-c316-4ee8-a809-35e3b62afbcb | tcp         | 0.0.0.0/0 | 80:80      | None                  |
   | f2404feb-c8e7-4176-b987-6292277b0c72 | tcp         | 0.0.0.0/0 | 443:443    | None                  |
   +--------------------------------------+-------------+-----------+------------+-----------------------+
   

4. 新增 default 的 security group rule，開放 3128/tcp。

   [root@controller ~]# openstack security group rule create default \
   --protocol tcp --dst-port 3128:3128 --remote-ip 0.0.0.0/0
   +-------------------+--------------------------------------+
   | Field             | Value                                |
   +-------------------+--------------------------------------+
   | created_at        | 2020-01-16T06:43:23Z                 |
   | description       |                                      |
   | direction         | ingress                              |
   | ether_type        | IPv4                                 |
   | id                | b170cb0c-0d94-4e11-8f10-7e30c624cfbe |
   | name              | None                                 |
   | port_range_max    | 3128                                 |
   | port_range_min    | 3128                                 |
   | project_id        | 92d1ec3e04384ad599c1a8f5aed73663     |
   | protocol          | tcp                                  |
   | remote_group_id   | None                                 |
   | remote_ip_prefix  | 0.0.0.0/0                            |
   | revision_number   | 0                                    |
   | security_group_id | 1f149288-87c2-43b5-a3b3-89eb153c9249 |
   | updated_at        | 2020-01-16T06:43:23Z                 |
   +-------------------+--------------------------------------+
   

5. 列出 default 的 security group rule。

   [root@controller ~]# openstack security group rule list default
   +--------------------------------------+-------------+-----------+------------+-----------------------+
   | ID                                   | IP Protocol | IP Range  | Port Range | Remote Security Group |
   +--------------------------------------+-------------+-----------+------------+-----------------------+
   | 0e52cde4-637b-4c35-be1e-cc1b4a1c0518 | icmp        | 0.0.0.0/0 |            | None                  |
   | b170cb0c-0d94-4e11-8f10-7e30c624cfbe | tcp         | 0.0.0.0/0 | 3128:3128  | None                  |
   | bc34846d-4398-4c7c-a250-33d37f363242 | tcp         | 0.0.0.0/0 | 22:22      | None                  |
   | da8408df-c316-4ee8-a809-35e3b62afbcb | tcp         | 0.0.0.0/0 | 80:80      | None                  |
   | f2404feb-c8e7-4176-b987-6292277b0c72 | tcp         | 0.0.0.0/0 | 443:443    | None                  |
   +--------------------------------------+-------------+-----------+------------+-----------------------+