Transcript
In this screencast, we will walk through the process of creating the security groups, assigning them to the virtual network as well as assigning them to the individual VMs. Then we will verify the security groups in action by trying to establish a connection to the web server from two virtual machines on the same network. Consider security groups as a host-level firewall to stop the traffic flow before it reaches the virtual machine's virtual network cards. Each group is a set of individual rules. Security groups can operate in both directions, inbound and outbound. As a source or destination, you can use specific IPs, openable a virtual network, or target all networks. Security groups are restrictive by default, meaning that whatever is not explicitly allowed is denied. Be aware of the default security group. It has two rules to allow the traffic flow in both directions without any restrictions. You can find the following configuration options. Configuration that can be inbound or outbound. In the protocol field, you must pick the protocol from the list. In the port range field, you can define ports in a variety of methods. Ranges separated with a dash symbol, individual ports separated by a comma, or a combination of both. Alternatively, you can choose to allow all ports. The target network field is the tricky one. The meaning of this setting is defined by the direction setting. If the direction is set to outbound, then this parameter is going to define the destination. But if the direction is set to inbound, then this parameter is going to define the source network. For this demonstration, the environment has the following setup. One OpenSUSE 15 virtual machine with NGINX installed and a custom index.html page. Two Microsoft Windows-based virtual machines to act as client machines. All virtual machines are using the same VXLAN EVPN network and are located on three different hosts. The virtual network address range is set to 48 addresses starting with 172.17.2.200. In the scope of this demonstration, I'm going to add three security groups. A security group with the name outbound-sg to allow any outbound traffic from the VMs. This will ensure that VMs can communicate with the outside world. A security group named webserver-sg to allow the inbound traffic to port 22-tcp from any source and the inbound port 80-tcp, accessible from a specific IP address only. A security group named rdp-sg to allow RDP connections from any source. The outbound security group is going to be attached to the whole virtual network and will appear on all VMs. The rdp-sg security group is only going to be attached to the virtual network card on the client VMs. The webserver-sg is going to be attached to the virtual network card on the webserver VM. The management of security groups is located under Networks, Security Groups tab. By default, there is only the default security group. Press the Create button to start the security group creation wizard. I'm going to add the outbound-sg first. Proceed to the Rules Configuration screen. In the direction, select Outbound. Set the protocol to All. Port range to All and target network as any network. Don't forget to press the Add button and then Finish to save the changes. Start the wizard once again. The next security group is going to be named webserver-sg. Set the direction to inbound, protocol to TCP, port range to 22 and target network to any network. Now add another rule to the group. Direction and protocol should remain the same, while the port must be changed to 80 and the target network set to manual. With the first IP defined as 172.17.2.205 and the size of 1. Lastly, add a third security group named rdp-sg to permit inbound RDP connections from any source. In order for security groups to be effective, they must be attached to a virtual network or to an individual virtual network card on the VM. The outbound-sg is universal, thus it makes sense to attach it at the virtual network level. Navigate to the Virtual Networks page and select the virtual network. Press Update, navigate to the Security tab, remove the default security group and select the outbound-sg security group. Press the Finish button to save changes. Now it's time to instantiate three virtual machines and complete the verification. Navigate to the virtual machines and press the Create button. In the scope of this demonstration, I'm going to use Windows-based virtual machines as the client machines, however, any operating system with a browser or command line is suitable. Name the virtual machine as the client-0, verify that the virtual network card is attached to the correct virtual network, and press the Finish button to deploy. Deploy the second client virtual machine from the same template. Navigate to the Networks tab and this time press Edit. Skip to the Network Values tab to override the assigned IP address, since I'm allowing an access to the web server port 80 only from the IP address 172.17.2.205, I'm going to set this IP to be assigned to the second client machine. Press the Finish button to place the VM in the queue. Lastly, the web server VM needs to be deployed. This virtual machine already has the web server running, so no modifications are needed. Wait until the VMs are running and check the first client's Info tab. Switch to the Networks, expand Security Groups under the network card and press the Attach Security Group button. Select RDP-SG and press the Accept button. Perform the same action with the second client. Perform the same action with the web server, but this time select the web server SG security group instead. Once all VMs are ready and security groups are attached, it's time to verify the security groups in action. Open the VNC console of the client 0 machine, which is the VM that has its IP address assigned automatically by OpenNebula. In the browser, navigate to the web server IP, in my case it is 172.17.2.201. In a while, you are supposed to get an error message. Open the VNC console of the second client VM, the one that has its IP overridden. Visit the same page and you should be greeted with the landing page confirming that the web server is reachable. And this concludes the screencast where we've successfully implemented network traffic filtering using the security groups functionality of OpenNebula. Thank you for watching and see you in the next screencast.
