Demonstrating traffic flow through a firewall
To see how firewall policies are applied to a Neutron router, take note of the following firewall rule, which allows HTTP traffic from any source to any destination on TCP port 80:
Figure 11.10
The firewall rule was applied to the policy named MyFirewallPolicy as shown in the following screenshot:
Figure 11.11
As the final step, the policy is associated with a firewall, MyFirewall, as shown in the following screenshot:
Figure 11.12
Examining the chains
Once a firewall is created, the rules within the firewall policy are implemented on the associated router. Running iptables -L -t filter or iptables-save within a router namespace reveals the iptables rules that are implemented by the L3 agent. For readability, only the filter table is shown in the following screenshot:
Figure 11.13
As with security groups, the FORWARD chain is used as the traffic is forwarded through the namespace rather than directed at it:
-A FORWARD -j neutron-filter-top -A FORWARD...
