[firewall rules] Additional documentation for filters in the API

[karencfv]

Not sure if this is the right repo for this issue, happy to move it if it belongs elsewhere.

I have some firewall rules that don't specify any ports in the filters:

$ oxide vpc firewall-rules view --vpc fa59febf-92a0-4eb7-8eae-0ff62258502b
success
VpcFirewallRules {
    rules: [
        VpcFirewallRule {
            action: Allow,
            description: "allow all connections from anywhere",
            direction: Inbound,
            filters: VpcFirewallRuleFilter {
                hosts: None,
                ports: None,
                protocols: Some(
                    [
                        Icmp,
                        Tcp,
                        Udp,
                    ],
                ),
            },
            id: 9714b9bc-b4d5-4023-bc83-123222ada61e,
            name: Name(
                "allow-all",
            ),
            priority: 65533,
            status: Enabled,
            targets: [
                Vpc(
                    Name(
                        "calico-test",
                    ),
                ),
            ],
            time_created: 2024-07-10T05:32:26.683745Z,
            time_modified: 2024-07-10T05:32:26.683745Z,
            vpc_id: fa59febf-92a0-4eb7-8eae-0ff62258502b,
        },
        VpcFirewallRule {
            action: Allow,
            description: "allow all outbound traffic to anywhere",
            direction: Outbound,
            filters: VpcFirewallRuleFilter {
                hosts: None,
                ports: None,
                protocols: Some(
                    [
                        Icmp,
                        Tcp,
                        Udp,
                    ],
                ),
            },
            id: 29d53e48-b79d-444a-b91f-3e5996798e98,
            name: Name(
                "allow-internal-outbound",
            ),
            priority: 65534,
            status: Enabled,
            targets: [
                Vpc(
                    Name(
                        "calico-test",
                    ),
                ),
            ],
            time_created: 2024-07-10T05:32:26.683753Z,
            time_modified: 2024-07-10T05:32:26.683753Z,
            vpc_id: fa59febf-92a0-4eb7-8eae-0ff62258502b,
        },
    ],
}

When i try to connect using port 80 the connection is refused

$ nc -v 45.154.216.153 80
nc: connect to 45.154.216.153 port 80 (tcp) failed: Connection refused

When I try to connect using port 22 the connection succeeds

$ nc -v 45.154.216.153 22
Connection to 45.154.216.153 22 port [tcp/ssh] succeeded!
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.3

Is this expected? It feels a bit odd to have some ports enabled by default and others not

[FelixMcFelix]

I believe this is expected; the firewall isn't blocking any traffic, from what I can see. If we were blocking the traffic on port 80, then I think we'd see a timeout when opening the TCP socket (as, e.g., the SYN would never reach the guest). Instead, it looks like we're seeing the guest send a TCP RST and kill the connection. That could be due to not having any socket bound/listening on port 80, or firewall config in the guest.

[karencfv]

Awesome thanks!

So, just to clarify, if we don't specify any ports then all ports are allowed? Perhaps we should document this somewhere 🤔

[david-crespo]

That’s a property of all the things we call “filters” — that’s what makes them filters. I agree we need to explain this every chance we get.

[karencfv]

The user may not be using the console, perhaps the docs can live directly on the API

[david-crespo]

Definitely. I’ll make a note to check the doc comments on the firewall rule types and see how they get handled by the openapi schema and the docs site.

[karencfv]

Thanks! Happy to help as well :)