# Generated by iptables-save v1.4.21 on Sat Mar 28 06:24:23 2020
*mangle
:PREROUTING ACCEPT [874050:1847659637]
:INPUT ACCEPT [874050:1847659637]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [866699:233413802]
:POSTROUTING ACCEPT [866699:233413802]
COMMIT
# Completed on Sat Mar 28 06:24:23 2020
# Generated by iptables-save v1.4.21 on Sat Mar 28 06:24:23 2020
*raw
:PREROUTING ACCEPT [873834:1847637992]
:OUTPUT ACCEPT [866481:233392077]
:neutron-openvswi-OUTPUT - [0:0]
:neutron-openvswi-PREROUTING - [0:0]
-A PREROUTING -j neutron-openvswi-PREROUTING
-A OUTPUT -j neutron-openvswi-OUTPUT
COMMIT
# Completed on Sat Mar 28 06:24:23 2020
# Generated by iptables-save v1.4.21 on Sat Mar 28 06:24:23 2020
*nat
:PREROUTING ACCEPT [76:19238]
:INPUT ACCEPT [76:19238]
:OUTPUT ACCEPT [43080:2609936]
:POSTROUTING ACCEPT [43077:2609816]
:DOCKER - [0:0]
-A PREROUTING -d 169.254.169.254/32 -i br-ctlplane -p tcp -m multiport --dports 80 -m state --state NEW -m comment --comment "144 undercloud metadata nat ipv4" -j REDIRECT --to-ports 8775
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 10.0.0.0/24 -d 10.0.0.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "137 routed_network return src 10.0.0.1/24 dest 10.0.0.1/24 ipv4" -j RETURN
-A POSTROUTING -s 192.168.24.0/24 -d 192.168.24.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "137 routed_network return src 192.168.24.0/24 dest 192.168.24.0/24 ipv4" -j RETURN
-A POSTROUTING -s 10.0.0.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "138 routed_network masquerade 10.0.0.1/24 ipv4" -j MASQUERADE
-A POSTROUTING -s 192.168.24.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "138 routed_network masquerade 192.168.24.0/24 ipv4" -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Sat Mar 28 06:24:23 2020
# Generated by iptables-save v1.4.21 on Sat Mar 28 06:24:23 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [8:416]
:DOCKER - [0:0]
:DOCKER-ISOLATION - [0:0]
:neutron-filter-top - [0:0]
:neutron-openvswi-FORWARD - [0:0]
:neutron-openvswi-INPUT - [0:0]
:neutron-openvswi-OUTPUT - [0:0]
:neutron-openvswi-local - [0:0]
:neutron-openvswi-sg-chain - [0:0]
:neutron-openvswi-sg-fallback - [0:0]
:openstack-INPUT - [0:0]
-A INPUT -p udp -m udp -m multiport --dports 6230,6231,6232 -m state --state NEW -m comment --comment fencing_access_from_overcloud -j ACCEPT
-A INPUT -j neutron-openvswi-INPUT
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "000 accept related established rules ipv4" -j ACCEPT
-A INPUT -p icmp -m state --state NEW -m comment --comment "001 accept all icmp ipv4" -j ACCEPT
-A INPUT -i lo -m state --state NEW -m comment --comment "002 accept all to lo interface ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -m state --state NEW -m comment --comment "003 accept ssh from all ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -m state --state NEW -m comment --comment "003 accept ssh from any ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9292 -m state --state NEW -m comment --comment "100 glance_api_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13292 -m state --state NEW -m comment --comment "100 glance_api_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8004 -m state --state NEW -m comment --comment "100 heat_api_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13004 -m state --state NEW -m comment --comment "100 heat_api_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8000 -m state --state NEW -m comment --comment "100 heat_cfn_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13005 -m state --state NEW -m comment --comment "100 heat_cfn_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 5050 -m state --state NEW -m comment --comment "100 ironic-inspector_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13050 -m state --state NEW -m comment --comment "100 ironic-inspector_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 6385 -m state --state NEW -m comment --comment "100 ironic_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13385 -m state --state NEW -m comment --comment "100 ironic_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 35357 -m state --state NEW -m comment --comment "100 keystone_admin_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 5000 -m state --state NEW -m comment --comment "100 keystone_public_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13000 -m state --state NEW -m comment --comment "100 keystone_public_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8989 -m state --state NEW -m comment --comment "100 mistral_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13989 -m state --state NEW -m comment --comment "100 mistral_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 3306 -m state --state NEW -m comment --comment "100 mysql_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9696 -m state --state NEW -m comment --comment "100 neutron_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13696 -m state --state NEW -m comment --comment "100 neutron_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8775 -m state --state NEW -m comment --comment "100 nova_metadata_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8774 -m state --state NEW -m comment --comment "100 nova_osapi_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13774 -m state --state NEW -m comment --comment "100 nova_osapi_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8778 -m state --state NEW -m comment --comment "100 nova_placement_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13778 -m state --state NEW -m comment --comment "100 nova_placement_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8080 -m state --state NEW -m comment --comment "100 swift_proxy_server_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13808 -m state --state NEW -m comment --comment "100 swift_proxy_server_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 3000 -m state --state NEW -m comment --comment "100 ui_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 443 -m state --state NEW -m comment --comment "100 ui_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8888 -m state --state NEW -m comment --comment "100 zaqar_api_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 13888 -m state --state NEW -m comment --comment "100 zaqar_api_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9000 -m state --state NEW -m comment --comment "100 zaqar_ws_haproxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9000 -m state --state NEW -m comment --comment "100 zaqar_ws_haproxy_ssl ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 873,3306,4444,4567,4568,9200 -m state --state NEW -m comment --comment "104 mysql galera ipv4" -j ACCEPT
-A INPUT -p udp -m multiport --dports 123 -m state --state NEW -m comment --comment "105 ntp ipv4" -j ACCEPT
-A INPUT -p vrrp -m state --state NEW -m comment --comment "106 keepalived vrrp ipv4" -j ACCEPT
-A INPUT -p vrrp -m state --state NEW -m comment --comment "106 neutron_l3 vrrp ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 1993 -m state --state NEW -m comment --comment "107 haproxy stats ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 4369,5672,25672 -m state --state NEW -m comment --comment "109 rabbitmq ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 5000,13000,35357 -m state --state NEW -m comment --comment "111 keystone ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9292,13292 -m state --state NEW -m comment --comment "112 glance_api ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8774,13774,8775 -m state --state NEW -m comment --comment "113 nova_api ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9000,8888,3000,13888 -m state --state NEW -m comment --comment "113 zaqar_api ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 9696,13696 -m state --state NEW -m comment --comment "114 neutron api ipv4" -j ACCEPT
-A INPUT -p udp -m multiport --dports 67 -m state --state NEW -m comment --comment "115 neutron dhcp input ipv4" -j ACCEPT
-A INPUT -p udp -m multiport --dports 4789 -m state --state NEW -m comment --comment "118 neutron vxlan networks ipv4" -j ACCEPT
-A INPUT -s 192.168.24.0/24 -p tcp -m multiport --dports 11211 -m state --state NEW -m comment --comment "121 memcached ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8080,13808 -m state --state NEW -m comment --comment "122 swift proxy ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 873,6000,6001,6002 -m state --state NEW -m comment --comment "123 swift storage ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8004,13004 -m state --state NEW -m comment --comment "125 heat_api ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8000,13800 -m state --state NEW -m comment --comment "125 heat_cfn ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 6385,13385 -m state --state NEW -m comment --comment "133 ironic api ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8989,13989 -m state --state NEW -m comment --comment "133 mistral ipv4" -j ACCEPT
-A INPUT -p udp -m multiport --dports 69 -m state --state NEW -m comment --comment "134 ironic conductor TFTP ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8088 -m state --state NEW -m comment --comment "135 ironic conductor HTTP ipv4" -j ACCEPT
-A INPUT -p gre -m comment --comment "136 neutron gre networks ipv4" -j ACCEPT
-A INPUT -i br-ctlplane -p udp -m multiport --dports 67 -m state --state NEW -m comment --comment "137 ironic-inspector dhcp input ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 5050 -m state --state NEW -m comment --comment "137 ironic-inspector ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8778,13778 -m state --state NEW -m comment --comment "138 nova_placement ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8775,13775 -m state --state NEW -m comment --comment "139 nova_metadata ipv4" -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8787,13787 -m state --state NEW -m comment --comment "155 docker-registry ipv4" -j ACCEPT
-A INPUT -s 38.102.83.41/32 -j ACCEPT
-A INPUT -s 192.168.103.200/32 -j ACCEPT
-A INPUT -j openstack-INPUT
-A INPUT -m state --state NEW -m limit --limit 20/min --limit-burst 15 -m comment --comment "998 log all ipv4" -j LOG
-A INPUT -m state --state NEW -m comment --comment "999 drop all ipv4" -j DROP
-A FORWARD -j neutron-filter-top
-A FORWARD -j neutron-openvswi-FORWARD
-A FORWARD -s 10.0.0.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "139 routed_network forward source 10.0.0.1/24 ipv4" -j ACCEPT
-A FORWARD -s 192.168.24.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "139 routed_network forward source 192.168.24.0/24 ipv4" -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "140 routed_network forward destinations 10.0.0.1/24 ipv4" -j ACCEPT
-A FORWARD -d 192.168.24.0/24 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment "140 routed_network forward destinations 192.168.24.0/24 ipv4" -j ACCEPT
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A OUTPUT -j neutron-filter-top
-A OUTPUT -j neutron-openvswi-OUTPUT
-A OUTPUT -p udp -m multiport --dports 68 -m state --state NEW -m comment --comment "116 neutron dhcp output ipv4" -j ACCEPT
-A OUTPUT -p udp -m multiport --dports 68 -m state --state NEW -m comment --comment "137 ironic-inspector dhcp output ipv4" -j ACCEPT
-A DOCKER-ISOLATION -j RETURN
-A neutron-filter-top -j neutron-openvswi-local
-A neutron-openvswi-FORWARD -m physdev --physdev-out tap9934f2c7-3e --physdev-is-bridged -m comment --comment "Accept all packets when port is trusted." -j ACCEPT
-A neutron-openvswi-FORWARD -m physdev --physdev-in tap9934f2c7-3e --physdev-is-bridged -m comment --comment "Accept all packets when port is trusted." -j ACCEPT
-A neutron-openvswi-sg-chain -j ACCEPT
-A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
-A openstack-INPUT -i lo -j ACCEPT
-A openstack-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A openstack-INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A openstack-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A openstack-INPUT -p tcp -m state --state NEW -m tcp --dport 19885 -j ACCEPT
-A openstack-INPUT -s 172.24.4.0/23 -p udp -m udp --dport 69 -j ACCEPT
-A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 6385 -j ACCEPT
-A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 80 -j ACCEPT
-A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 8000 -j ACCEPT
-A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 8003 -j ACCEPT
-A openstack-INPUT -s 172.24.4.0/23 -p tcp -m tcp --dport 8004 -j ACCEPT
-A openstack-INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables dropped: "
-A openstack-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Sat Mar 28 06:24:23 2020