Bases: nova.virt.firewall.IptablesFirewallDriver
No-op. Everything is done in prepare_instance_filter
Check nova-instance-instance-xxx exists
Set up provider rules and basic NWFilter.
Bases: nova.virt.firewall.FirewallDriver
This class implements a network filtering mechanism by using libvirt’s nwfilter. all instances get a filter (“nova-base”) applied. This filter provides some basic security such as protection against MAC spoofing, IP spoofing, and ARP spoofing.
No-op. Everything is done in prepare_instance_filter
Check nova-instance-instance-xxx exists
The standard allow-dhcp-server filter is an <ip> one, so it uses ebtables to allow traffic through. Without a corresponding rule in iptables, it’ll get blocked anyway.
Set up basic filtering (MAC, IP, and ARP spoofing protection)
Clear out the nwfilter rules.