Support Firewall for public IPs in VPC by harikrishna-patnala · Pull Request #12706 · apache/cloudstack

harikrishna-patnala · 2026-02-25T10:05:37Z

Description

This PR adds support for firewall rules on public IPs in VPC networks.

Doc PR apache/cloudstack-documentation#633

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

harikrishna-patnala · 2026-02-25T11:40:07Z

@blueorangutan package

blueorangutan · 2026-02-25T11:42:08Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-25T12:34:01Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16942

Copilot

Pull request overview

This PR adds support for firewall rules on public IPs in VPC networks, which were previously only available for non-VPC isolated networks. This is a major feature addition that enables VPC users to configure ingress/egress firewall rules on their public IP addresses, similar to the functionality available in traditional isolated networks.

Changes:

Enabled Firewall service for VPC offerings and networks by removing it from the list of non-supported services
Added Firewall capability to VpcVirtualRouterElement by removing the code that previously excluded it
Updated UI to show firewall tabs for VPC public IPs in various states (source NAT, static NAT, port forwarding, load balancing)
Implemented iptables firewall chain logic in VPC virtual routers to support per-public-IP firewall rules
Added database migration to retrofit existing VPC offerings, VPC networks, and VPCs with Firewall service

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
ui/src/views/offering/AddVpcOffering.vue	Adds Firewall service with VpcVirtualRouter provider to the list of services when creating VPC offerings
ui/src/views/network/PublicIpResource.vue	Updates tab visibility logic to show firewall tab for VPC IPs in various states (source NAT, static NAT, etc.)
systemvm/debian/opt/cloud/bin/cs/CsAddress.py	Implements PREROUTING firewall chain jump and firewall chain with default DROP policy for public IPs in VPC routers
systemvm/debian/opt/cloud/bin/configure.py	Modifies ACL processing to use AclIP (per-IP firewall) instead of AclDevice for VPC firewall rules
server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java	Removes VPCVirtualRouter check from isVirtualRouterGateway method for Network parameter
server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java	Removes Service.Firewall from the list of non-supported VPC services
server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java	Re-enables Firewall capability for VPC Virtual Router by removing the code that excluded it
server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java	Updates network offering validation to no longer automatically set forVpc=false when Firewall service is included
plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java	Updates Kubernetes VPC network offering creation to include Firewall service with VPCVirtualRouter provider
engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java	Adds database migration to insert Firewall service mappings for existing VPC offerings, networks, and VPCs
engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java	Adds Firewall service to default VPC offering providers

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

blueorangutan · 2026-02-26T05:33:29Z

[SF] Trillian Build Failed (tid-15532)

harikrishna-patnala · 2026-02-26T06:31:14Z

@blueorangutan package

blueorangutan · 2026-02-26T06:32:05Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-02-26T06:35:25Z

Codecov Report

❌ Patch coverage is 21.96078% with 398 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.48%. Comparing base (8996286) to head (60186e4).
⚠️ Report is 24 commits behind head on main.

Files with missing lines	Patch %	Lines
...om/cloud/network/firewall/FirewallManagerImpl.java	45.54%	82 Missing and 22 partials ⚠️
...udstack/network/topology/BasicNetworkTopology.java	0.00%	72 Missing ⚠️
...cloud/network/element/VpcVirtualRouterElement.java	0.00%	28 Missing ⚠️
.../main/java/com/cloud/network/NetworkModelImpl.java	0.00%	25 Missing ⚠️
...a/com/cloud/network/router/CommandSetupHelper.java	0.00%	24 Missing ⚠️
...n/java/com/cloud/network/IpAddressManagerImpl.java	38.23%	14 Missing and 7 partials ⚠️
...src/main/java/com/cloud/api/ApiResponseHelper.java	0.00%	20 Missing ⚠️
.../router/VpcVirtualNetworkApplianceManagerImpl.java	0.00%	15 Missing ⚠️
...i/command/user/firewall/CreateFirewallRuleCmd.java	44.44%	7 Missing and 3 partials ⚠️
...va/com/cloud/network/dao/FirewallRulesDaoImpl.java	0.00%	10 Missing ⚠️
... and 18 more

Additional details and impacted files

@@ Coverage Diff @@## main #12706 +/- ##
==========================================
Coverage 19.47% 19.48% - Complexity 19352 19395 +43 
==========================================
Files 6294 6296 +2 Lines 568164 568626 +462 Branches 69600 69713 +113 ==========================================
+ Hits 110664 110810 +146 - Misses 445422 445677 +255 - Partials 12078 12139 +61

Flag	Coverage Δ
uitests	`3.44% <ø> (-0.01%)`	⬇️
unittests	`20.74% <21.96%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

harikrishna-patnala · 2026-02-26T06:59:15Z

@blueorangutan package

blueorangutan · 2026-02-26T07:00:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-26T08:16:09Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16957

harikrishna-patnala · 2026-02-26T09:29:34Z

@blueorangutan package

blueorangutan · 2026-02-26T09:32:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-26T10:28:52Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16959

harikrishna-patnala · 2026-03-02T05:42:11Z

@blueorangutan package

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

harikrishna-patnala · 2026-07-10T07:59:28Z

@blueorangutan package

blueorangutan · 2026-07-10T08:00:05Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-07-10T08:46:03Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18527

kiranchavala

LGTM

Verified manually

Need to make sure firewall is a supported service when creating a vpc offering

Able to assign firewall rules to the public ip address acquired in a vpc network

Navigate to a vpc > Public ip address > acuire a public ip > Assign firewall rules

weizhouapache

code and design lgtm

weizhouapache · 2026-07-13T07:13:44Z

merging based on approvals and manual tests, thanks @harikrishna-patnala @kiranchavala @vishesh92

weizhouapache · 2026-07-13T11:41:52Z

@harikrishna-patnala
could you please have a look at the CI failures ?
thanks

boring-cyborgBot added component:kubernetes component:networking component:orchestration component:UI component:virtual-router Python Warning... Python code Ahead! labels Feb 25, 2026

harikrishna-patnala added this to the 4.23.0 milestone Feb 25, 2026

boring-cyborgBot added the component:vpc label Feb 25, 2026

sureshanaparti requested a review from Copilot February 26, 2026 04:35

Copilotstarted reviewing on behalf of sureshanaparti February 26, 2026 04:36 View session

CopilotAI reviewed Feb 26, 2026
View reviewed changes

boring-cyborgBot added the component:management-server label Feb 26, 2026

harikrishna-patnala requested a review from Copilot February 26, 2026 06:26

Copilotstarted reviewing on behalf of harikrishna-patnala February 26, 2026 06:26 View session

CopilotAI reviewed Feb 26, 2026
View reviewed changes

harikrishna-patnala mentioned this pull request Mar 2, 2026
Add section about Firewall rules on a public IP address in a VPC apache/cloudstack-documentation#633
Merged

harikrishna-patnala added 16 commits July 10, 2026 13:19

marvin test
15e67de

more unit tests
9d71704

Fix UnnecessaryStubbingException
413a9f6

Fix possible NPE
e3a4f6a

Fix whitespace
57c1a21

Fix vpc uuid in response
5b973d4

Add Firewall in clone VPC offering in UI form
994836a

changes for VPC with firewall and without capabilities
aa39b20

Add VPC firewall check
6f46621

UI fix for VPC no firewall
f75771b

Make the drop rule add by default
1497807

Fix restart VPC with cleanup
f0171f9

Fix cleanup order
3dadaa5

Fix FW rule application on a VPC not having tiers
d029be6

Fix firewall option in network offering creation when vpc is enabled
19d49ab

Fix UI
60186e4

CopilotAI review requested due to automatic review settings July 10, 2026 07:59

harikrishna-patnala force-pushed the FWinVPCpublicIP branch from a6c04ae to 60186e4Compare July 10, 2026 07:59

CopilotAI reviewed Jul 10, 2026

github-actionsBot removed the status:has-conflicts label Jul 10, 2026

kiranchavala approved these changes Jul 13, 2026
View reviewed changes

harikrishna-patnala marked this pull request as ready for review July 13, 2026 07:08

weizhouapache approved these changes Jul 13, 2026
View reviewed changes

weizhouapache merged commit 13822b1 into apache:mainJul 13, 2026
18 of 27 checks passed

weizhouapache deleted the FWinVPCpublicIP branch July 13, 2026 07:14

Uh oh!

Conversation

harikrishna-patnala commented Feb 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

harikrishna-patnala commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

harikrishna-patnala commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

codecovBot commented Feb 26, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harikrishna-patnala commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

harikrishna-patnala commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

blueorangutan commented Feb 26, 2026

Uh oh!

harikrishna-patnala commented Mar 2, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Uh oh!

harikrishna-patnala commented Jul 10, 2026

Uh oh!

blueorangutan commented Jul 10, 2026

Uh oh!

blueorangutan commented Jul 10, 2026

Uh oh!

kiranchavala left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented Jul 13, 2026

Uh oh!

harikrishna-patnala commented Feb 25, 2026•
edited
Loading

codecovBot commented Feb 26, 2026•
edited
Loading