need to insert iptable rules into FORWARD chain instead of append, as on rhel6, there is a reject rule added at the end of FORWARD

edisonSu · edisonSu · commit 29c510de289b · 2011-05-13T16:05:20.000-04:00
diff --git a/python/lib/cloudutils/serviceConfig.py b/python/lib/cloudutils/serviceConfig.py
@@ -73,7 +73,8 @@ def isPreConfiged(self):
         preCfged = False
         for br in self.syscfg.env.nics:
             if not self.netcfg.isNetworkDev(br):
-                raise CloudInternalException("%s is not a network device, is it down?"%br)
+                logging.debug("%s is not a network device, is it down?"%br)
+                return False
             if not self.netcfg.isBridge(br):
                 raise CloudInternalException("%s is not a bridge"%br)
             preCfged = True
diff --git a/scripts/vm/network/security_group.py b/scripts/vm/network/security_group.py
@@ -591,15 +591,16 @@ def addFWFramework(brname):
     try:
         refs = execute("iptables -n -L  " + brfw + " |grep " + brfw + " | cut -d \( -f2 | awk '{print $1}'").strip()
         if refs == "0":
-            execute("iptables -A FORWARD -i " + brname + " -m physdev --physdev-is-bridged -j " + brfw)
-            execute("iptables -A FORWARD -o " + brname + " -m physdev --physdev-is-bridged -j " + brfw)
+            execute("iptables -I FORWARD -i " + brname + " -j DROP")
+            execute("iptables -I FORWARD -o " + brname + " -j DROP")
+            execute("iptables -I FORWARD -i " + brname + " -m physdev --physdev-is-bridged -j " + brfw)
+            execute("iptables -I FORWARD -o " + brname + " -m physdev --physdev-is-bridged -j " + brfw)
             phydev = execute("brctl show |grep " + brname + " | awk '{print $4}'").strip()
             execute("iptables -A " + brfw + " -m physdev --physdev-is-bridged --physdev-out " + phydev + " -j ACCEPT")
             execute("iptables -A " + brfw + " -m state --state RELATED,ESTABLISHED -j ACCEPT")
             execute("iptables -A " + brfw + " -m physdev --physdev-is-bridged --physdev-is-out -j " + brfwout)
             execute("iptables -A " + brfw + " -m physdev --physdev-is-bridged --physdev-is-in -j " + brfwin)
-            execute("iptables -A FORWARD -i " + brname + " -j DROP")
-            execute("iptables -A FORWARD -o " + brname + " -j DROP")
+           
     
         return True
     except:
