This plugin applies Neutron firewalls to objects like projects, routers, and router ports. Openstack’s Neutron FWAAS centers on firewall rules and firewall policies. The firewall rules specify attributes like port ranges, protocol, and IP addresses to reconcile match criteria and act on matched traffic.
In Openstack’s new FWAAS v2 implementation, more granular actions are available. The firewall will consist of a ingress and egress policies, and firewall groups will apply at port level instead of router level. FWAAS uses iptables to apply policies to virtual routers within a project.
FWAAS supports:
L3 router firewalling
L3 router port firewalling
L2 firewalling (VM ports, including isolation using VLANs and tunneling)
CLI support
Horizon support
Multiple protocols (tcp, udp, icmp, any)
For teams to manually configure firewalls, they must permit traffic through the ports that each OpenStack service uses.