Support Firewall for public IPs in VPC by harikrishna-patnala · Pull Request #12706 · apache/cloudstack

harikrishna-patnala · 2026-02-25T10:05:37Z

Description

This PR adds support for firewall rules on public IPs in VPC networks.

Doc PR apache/cloudstack-documentation#633

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

harikrishna-patnala · 2026-02-25T11:40:07Z

@blueorangutan package

blueorangutan · 2026-02-25T11:42:08Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-25T12:34:01Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16942

Copilot

Pull request overview

This PR adds support for firewall rules on public IPs in VPC networks, which were previously only available for non-VPC isolated networks. This is a major feature addition that enables VPC users to configure ingress/egress firewall rules on their public IP addresses, similar to the functionality available in traditional isolated networks.

Changes:

Enabled Firewall service for VPC offerings and networks by removing it from the list of non-supported services
Added Firewall capability to VpcVirtualRouterElement by removing the code that previously excluded it
Updated UI to show firewall tabs for VPC public IPs in various states (source NAT, static NAT, port forwarding, load balancing)
Implemented iptables firewall chain logic in VPC virtual routers to support per-public-IP firewall rules
Added database migration to retrofit existing VPC offerings, VPC networks, and VPCs with Firewall service

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
ui/src/views/offering/AddVpcOffering.vue	Adds Firewall service with VpcVirtualRouter provider to the list of services when creating VPC offerings
ui/src/views/network/PublicIpResource.vue	Updates tab visibility logic to show firewall tab for VPC IPs in various states (source NAT, static NAT, etc.)
systemvm/debian/opt/cloud/bin/cs/CsAddress.py	Implements PREROUTING firewall chain jump and firewall chain with default DROP policy for public IPs in VPC routers
systemvm/debian/opt/cloud/bin/configure.py	Modifies ACL processing to use AclIP (per-IP firewall) instead of AclDevice for VPC firewall rules
server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java	Removes VPCVirtualRouter check from isVirtualRouterGateway method for Network parameter
server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java	Removes Service.Firewall from the list of non-supported VPC services
server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java	Re-enables Firewall capability for VPC Virtual Router by removing the code that excluded it
server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java	Updates network offering validation to no longer automatically set forVpc=false when Firewall service is included
plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java	Updates Kubernetes VPC network offering creation to include Firewall service with VPCVirtualRouter provider
engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java	Adds database migration to insert Firewall service mappings for existing VPC offerings, networks, and VPCs
engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java	Adds Firewall service to default VPC offering providers

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java

server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java

...ernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java

engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java

blueorangutan · 2026-02-26T05:33:29Z

[SF] Trillian Build Failed (tid-15532)

harikrishna-patnala · 2026-02-26T06:31:14Z

@blueorangutan package

blueorangutan · 2026-02-26T06:32:05Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-02-26T06:35:25Z

Codecov Report

❌ Patch coverage is 1.19048% with 83 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.92%. Comparing base (a5b6bc3) to head (1022c61).
⚠️ Report is 45 commits behind head on main.

Files with missing lines	Patch %	Lines
...ava/com/cloud/upgrade/dao/Upgrade42210to42300.java	0.00%	64 Missing ⚠️
...java/com/cloud/upgrade/DatabaseUpgradeChecker.java	0.00%	6 Missing ⚠️
...ain/java/com/cloud/network/vpc/VpcManagerImpl.java	16.66%	5 Missing ⚠️
...java/com/cloud/server/ConfigurationServerImpl.java	0.00%	4 Missing ⚠️
...ache/cloudstack/network/RoutedIpv4ManagerImpl.java	0.00%	2 Missing ⚠️
...tack/engine/orchestration/NetworkOrchestrator.java	0.00%	1 Missing ⚠️
...bernetes/cluster/KubernetesClusterManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12706      +/-   ##
============================================
+ Coverage     17.89%   17.92%   +0.03%     
- Complexity    16092    16159      +67     
============================================
  Files          5936     5939       +3     
  Lines        532734   533229     +495     
  Branches      65165    65250      +85     
============================================
+ Hits          95347    95600     +253     
- Misses       426711   426887     +176     
- Partials      10676    10742      +66

Flag	Coverage Δ
uitests	`3.66% <ø> (-0.02%)`	⬇️
unittests	`19.03% <1.19%> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java

server/src/main/java/com/cloud/server/ConfigurationServerImpl.java

harikrishna-patnala · 2026-02-26T06:59:15Z

@blueorangutan package

blueorangutan · 2026-02-26T07:00:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-26T08:16:09Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16957

harikrishna-patnala · 2026-02-26T09:29:34Z

@blueorangutan package

blueorangutan · 2026-02-26T09:32:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-26T10:28:52Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16959

harikrishna-patnala · 2026-03-02T05:42:11Z

@blueorangutan package

blueorangutan · 2026-03-02T05:44:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-03-02T06:35:40Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16983

Copilot

Pull request overview

Copilot reviewed 11 out of 13 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T11:14:52Z

ui/src/views/network/PublicIpResource.vue

+        // VPC IPs with static nat have firewall (only if associatednetworkid present)
        if (this.resource.isstaticnat) {
          if (this.resource.virtualmachinetype === 'DomainRouter') {
-            this.tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'vpn'))
+            let tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'vpn'))
+            if (this.resource.associatednetworkid) {
+              tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => ['vpn', 'firewall'].includes(tab.name)))
+            }
+            this.tabs = tabs


The updated comment says “VPC IPs with static nat have firewall…”, but in the virtualmachinetype === 'DomainRouter' branch the code still only adds the vpn tab unless associatednetworkid is present. Either adjust the comment to match the actual behavior, or update the tab logic to reflect the intended UX.

Copilot · 2026-03-02T11:14:52Z

engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java

+                                while (networksRs.next()) {
+                                    long networkId = networksRs.getLong(1);
+                                    try (PreparedStatement insertService = conn.prepareStatement(
+                                            "INSERT INGORE INTO `cloud`.`ntwk_service_map` " +


The SQL statement string has a typo: INSERT INGORE should be INSERT IGNORE. As written, this migration will fail at runtime when updating ntwk_service_map.

Suggested change

"INSERT INGORE INTO `cloud`.`ntwk_service_map` " +

"INSERT IGNORE INTO `cloud`.`ntwk_service_map` " +

Copilot · 2026-03-02T11:14:53Z

engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java


            for (String filePath : filesPathUnderViewsDirectory) {
-                LOGGER.debug("Executing PROCEDURE script [{}].", filePath);
+                LOGGER.debug(String.format("Executing PROCEDURE script [%s].", filePath));


Avoid String.format inside LOGGER.debug(...) here: it eagerly allocates even when debug logging is disabled and bypasses SLF4J parameterized logging. Prefer LOGGER.debug("Executing PROCEDURE script [{}].", filePath) (and similarly after normalizing filePath if you want the logged value to match what is executed).

Suggested change

LOGGER.debug(String.format("Executing PROCEDURE script [%s].", filePath));

LOGGER.debug("Executing PROCEDURE script [{}].", filePath);

Copilot · 2026-03-02T11:14:53Z

engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java

+                    filePath = filePath.substring(1);
+                }

                InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);


getResourceAsStream(filePath) can return null; runScript(conn, viewScript) will then throw a NullPointerException (not caught in runScript). Add a null check and throw a CloudRuntimeException that includes the resolved filePath to make failures actionable.

Suggested change

InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);

InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);

if (viewScript == null) {

String message = String.format("Unable to find PROCEDURE script resource [%s] on the classpath.", filePath);

LOGGER.error(message);

throw new CloudRuntimeException(message);

}

Copilot · 2026-03-02T11:14:53Z

engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java

+                LOGGER.debug(String.format("Executing VIEW script [%s].", filePath));
+                if (filePath.startsWith("/")) {
+                    filePath = filePath.substring(1);
+                }



Same as above: String.format eagerly builds the message even when debug logging is disabled. Prefer SLF4J parameterized logging (LOGGER.debug("Executing VIEW script [{}].", filePath)) and consider logging the normalized path if that’s what is executed.

Suggested change

LOGGER.debug(String.format("Executing VIEW script [%s].", filePath));

if (filePath.startsWith("/")) {

filePath = filePath.substring(1);

}

if (filePath.startsWith("/")) {

filePath = filePath.substring(1);

}

LOGGER.debug("Executing VIEW script [{}].", filePath);

Copilot · 2026-03-02T11:14:54Z

engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java

+                    filePath = filePath.substring(1);
+                }

                InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);


Same null-safety issue for view scripts: if getResourceAsStream(filePath) returns null, runScript will NPE. Add an explicit null check and fail with a clear exception that includes the script path.

Suggested change

InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);

InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);

if (viewScript == null) {

String message = String.format("VIEW script resource [%s] could not be found on the classpath.", filePath);

LOGGER.error(message);

throw new CloudRuntimeException(message);

}

Copilot · 2026-03-02T11:14:54Z

ui/src/views/offering/AddVpcOffering.vue

+        services.push({
+          name: 'Firewall',
+          provider: [
+            { name: 'VpcVirtualRouter' }
+          ]
+        })


Firewall is only added to the services list for the non-NSX/non-Netris path. Since the backend changes add Firewall support to VPC offerings (including NSX/Netris VPC offerings via VpcVirtualRouter), the UI should also include the Firewall service in the NSX and Netris branches; otherwise those offerings can’t be configured with Firewall from the UI.

vishesh92

I had some doubts about a few changes. Left some comments.

vishesh92 · 2026-03-02T10:42:41Z

engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java

+        updateVpcOfferingsWithFirewallService(conn);
+    }
+
+    private void updateNetworkDefaultOfferingsForVPCWithFirewallService(Connection conn) {


I am not sure if we should update the existing service offerings. IMO, it would be better to add new service offerings. This will change the behavior of a network after a network restart with cleanup.

vishesh92 · 2026-03-02T10:43:47Z

engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java

@@ -327,7 +327,10 @@ protected void executeProcedureScripts() {
            Connection conn = txn.getConnection();

            for (String filePath : filesPathUnderViewsDirectory) {
-                LOGGER.debug("Executing PROCEDURE script [{}].", filePath);
+                LOGGER.debug(String.format("Executing PROCEDURE script [%s].", filePath));


Suggested change

LOGGER.debug(String.format("Executing PROCEDURE script [%s].", filePath));

LOGGER.debug("Executing PROCEDURE script [{}].", filePath);

vishesh92 · 2026-03-02T10:44:08Z

engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java

@@ -439,7 +442,10 @@ protected void executeViewScripts() {
            Connection conn = txn.getConnection();

            for (String filePath : filesPathUnderViewsDirectory) {
-                LOGGER.debug("Executing VIEW script [{}].", filePath);
+                LOGGER.debug(String.format("Executing VIEW script [%s].", filePath));


Suggested change

LOGGER.debug(String.format("Executing VIEW script [%s].", filePath));

LOGGER.debug("Executing VIEW script [{}].", filePath);

vishesh92 · 2026-03-02T10:57:29Z

systemvm/debian/opt/cloud/bin/configure.py

+                 continue
+            if self.config.is_vpc() and not ("purpose" in self.dbag[item] and self.dbag[item]["purpose"] == "Firewall"):


Suggested change

continue

if self.config.is_vpc() and not ("purpose" in self.dbag[item] and self.dbag[item]["purpose"] == "Firewall"):

continue

if self.config.is_vpc() and not ("purpose" in self.dbag[item] and self.dbag[item]["purpose"] == "Firewall"):

vishesh92 · 2026-03-02T11:06:20Z

systemvm/debian/opt/cloud/bin/cs/CsAddress.py

@@ -632,6 +632,18 @@ def fw_vpcrouter(self):
                                (self.address['network'], self.address['network'])])

        if self.get_type() in ["public"]:
+            # Add PREROUTING firewall chain jump for public IP
+            self.fw.append(["mangle", "front",


We seem to be adding this for all the VPC Offerings which might not have firewall as a supported service.

vishesh92 · 2026-03-02T11:09:07Z

server/src/main/java/com/cloud/server/ConfigurationServerImpl.java

@@ -1186,6 +1188,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
                internalLbOffProviders.put(Service.Gateway, Provider.VPCVirtualRouter);
                internalLbOffProviders.put(Service.Lb, Provider.InternalLbVm);
                internalLbOffProviders.put(Service.SourceNat, Provider.VPCVirtualRouter);
+                internalLbOffProviders.put(Service.Firewall, Provider.VPCVirtualRouter);


I am not sure about this. But if the LB is internal, the firewall will work only on public traffic for VPC Virtual router. Is this change required here?

vishesh92 · 2026-03-02T11:12:48Z

...ernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java

        }
+        defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, Network.Provider.VPCVirtualRouter);


Suggested change

defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, Network.Provider.VPCVirtualRouter);

defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, forNsx ? Network.Provider.Nsx : provider);

vishesh92 · 2026-03-02T11:14:46Z

systemvm/debian/opt/cloud/bin/configure.py

-                continue
-            if self.config.is_vpc():
+                 continue
+            if self.config.is_vpc() and not ("purpose" in self.dbag[item] and self.dbag[item]["purpose"] == "Firewall"):


I am not exactly sure about this change.

vishesh92 · 2026-03-02T11:17:04Z

ui/src/views/offering/AddVpcOffering.vue

+        services.push({
+          name: 'Firewall',
+          provider: [
+            { name: 'VpcVirtualRouter' }


I am not sure if we can add providers (NSX, etc.) other than VpcVirtualRouter here.

Support Firewall for public IPs in VPC

7c0f30a

boring-cyborg bot added component:kubernetes component:networking component:orchestration component:UI component:virtual-router Python Warning... Python code Ahead! labels Feb 25, 2026

harikrishna-patnala added this to the 4.23.0 milestone Feb 25, 2026

default offering changes

2aaa7f7

boring-cyborg bot added the component:vpc label Feb 25, 2026

sureshanaparti requested a review from Copilot February 26, 2026 04:35

Copilot started reviewing on behalf of sureshanaparti February 26, 2026 04:36 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Fix default offerings

d4450b4

boring-cyborg bot added the component:management-server label Feb 26, 2026

harikrishna-patnala requested a review from Copilot February 26, 2026 06:26

Copilot started reviewing on behalf of harikrishna-patnala February 26, 2026 06:26 View session

few more fixes

8b950b2

Copilot AI reviewed Feb 26, 2026

View reviewed changes

some improvements

47bbce0

harikrishna-patnala added 2 commits February 26, 2026 14:10

Default service addition in vpcmanager

0a6468a

Fix vpc provider on service in the offering

f1f0cd0

UI fix

1022c61

harikrishna-patnala mentioned this pull request Mar 2, 2026

Add section about Firewall rules on a public IP address in a VPC apache/cloudstack-documentation#633

Open

vishesh92 requested a review from Copilot March 2, 2026 11:02

Copilot started reviewing on behalf of vishesh92 March 2, 2026 11:03 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

vishesh92 reviewed Mar 2, 2026

View reviewed changes

	"INSERT INGORE INTO `cloud`.`ntwk_service_map` " +
	"INSERT IGNORE INTO `cloud`.`ntwk_service_map` " +

	LOGGER.debug(String.format("Executing PROCEDURE script [%s].", filePath));
	LOGGER.debug("Executing PROCEDURE script [{}].", filePath);

-                InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);
+                InputStream viewScript = Thread.currentThread().getContextClassLoader().getResourceAsStream(filePath);
+                if (viewScript == null) {
+                    String message = String.format("Unable to find PROCEDURE script resource [%s] on the classpath.", filePath);
+                    LOGGER.error(message);
+                    throw new CloudRuntimeException(message);
+                }

	LOGGER.debug(String.format("Executing VIEW script [%s].", filePath));
	LOGGER.debug("Executing VIEW script [{}].", filePath);

		continue
		if self.config.is_vpc() and not ("purpose" in self.dbag[item] and self.dbag[item]["purpose"] == "Firewall"):

		}
		defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, Network.Provider.VPCVirtualRouter);

Conversation

harikrishna-patnala commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

harikrishna-patnala commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

harikrishna-patnala commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

codecov bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harikrishna-patnala commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

harikrishna-patnala commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

harikrishna-patnala commented Mar 2, 2026

Uh oh!

blueorangutan commented Mar 2, 2026

Uh oh!

blueorangutan commented Mar 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

harikrishna-patnala commented Feb 25, 2026 •

edited

Loading

codecov bot commented Feb 26, 2026 •

edited

Loading