Open all ICMP ports

[valkaitibor]

Terraform provider version

1.35.1

Affected Resource(s)

• opentelekomcloud_networking_secgroup_rule_v2

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.

resource "opentelekomcloud_networking_secgroup_rule_v2" "admin_secgroup_rule_rds_icmp" {
description = "all ICMP ports"
direction = "ingress"
ethertype = "IPv4"
protocol = "icmp"
port_range_min = 0
port_range_max = 255
remote_ip_prefix = "0.0.0.0/0"
security_group_id = opentelekomcloud_networking_secgroup_v2.admin_secgroup.id
}

Debug Output/Panic Output

Steps to Reproduce

1. terraform apply
2. No error messages, a new security group rule is created with ICMP: 0-255

Expected Behavior

A new security group rule should be created with ICMP: All. The ping should work.
My aim is to get the same result as creating the ICMP: All security group rule. On AWS, the port range min and max should be -1 to have the same result. On OTC, it is not working, the error message says that only numbers from 0 to 255 can be used. It is obvious that if I am setting the range from 0 to 255, it should cause the same result as the ICMP: All rule. But in the case of ICMP:0-255, the ping is not working between the ECSs. After I am adding the ICMP: All rule manually, the ping is working. However, for using an RDS, other ICMP ports should be opened, so I really need the option to create the ICMP: All rule with terraform. Please create the opportunity to use -1 to activate this rule.

Actual Behavior

A new security group rule is created with ICMP: 0-255. The ping is not working.

Important Factoids

References

• Urgent Bug: opentelekomcloud_networking_secgroup_rule_v2 not working #2162 (maybe this is similar, according to the OTC service desk)

[vladimirvshivkov]

icmp has no ports, so try to create rule without any ports like:

resource "opentelekomcloud_networking_secgroup_rule_v2" "admin_secgroup_rule_rds_icmp" {
    description = "all ICMP ports"
    direction = "ingress"
    ethertype = "IPv4"
    protocol = "icmp"
    remote_ip_prefix = "0.0.0.0/0"
    security_group_id = opentelekomcloud_networking_secgroup_v2.admin_secgroup.id
}

[valkaitibor]

If i am not specifying the port range, then it will be a port range min 0 and port range max 0 by default, which means the echo reply will be allowed, instead of icmp:all

[anton-sidelnikov]

Hi @valkaitibor, check on latest please