Elastic Port Forwarding ¶

Table of contents

Overview ¶

When user VMs are on a private network or isolated network with SNAT service enabled, they can reach outside network but cannot be reached by outside network, which is the nature of SNAT. Users can create port forwarding rules to allow outside network to reach specific ports of user VMs behind SNAT. ZStack supports elastic port forwarding rules, which means rules can be attached/detached to/from VMs on demand.

As the virtual router provider is the only network service provider in this ZStack version, a port forwarding rule is actually created between a virtual router VM’s public network and guest network.

A VIP can be used for multiple port forwarding rules, as long as rules’ port ranges don’t overlap; for example:

Port Forwarding Rule Inventory ¶

Properties ¶

Name	Description	Optional	Choices	Since
uuid	see Resource Properties			0.6
name	see Resource Properties			0.6
description	see Resource Properties	true		0.6
vipIp	IP address of VIP			0.6
guestIp	IP address of VM nic	true		0.6
vipUuid	uuid of VIP			0.6
vipPortStart	the start port of VIP		1 ~ 65535	0.6
vipPortEnd	the end port of VIP		1 ~ 65535	0.6
privatePortStart	the start port of guest IP		1 ~ 65535	0.6
privatePortEnd	the end port of guest IP		1 ~ 65535	0.6
vmNicUuid	uuid of guest VM nic	true		0.6
protocolType	protocol type of network traffic		TCP UDP	0.6
state	rule state, not implemented in this version		Enabled Disabled	0.6
allowedCidr	source CIDR; the port forwarding rule only applies to traffics with this source CIDR			0.6
createDate	see Resource Properties			0.6
lastOpDate	see Resource Properties			0.6

Example ¶

{
    "allowedCidr": "0.0.0.0/0",
    "createDate": "Dec 6, 2015 3:04:34 PM",
    "guestIp": "10.0.0.244",
    "lastOpDate": "Dec 6, 2015 3:04:34 PM",
    "name": "pf-9uf4",
    "privatePortEnd": 33,
    "privatePortStart": 33,
    "protocolType": "TCP",
    "state": "Enabled",
    "uuid": "310a6cd618144ca683d78d74307f16a4",
    "vipIp": "192.168.0.187",
    "vipPortEnd": 33,
    "vipPortStart": 33,
    "vipUuid": "433769b59a7c42199d762af01e08ec16",
    "vmNicUuid": "4b9c27321b794679a9ba8c18239bbb0d"
}

Operations ¶

Create Port Forwarding Rule ¶

Users can use CreatePortForwardingRule to create a port forwarding rule, with or without attaching to a VM nic. For example:

CreatePortForwardingRule name=pf1 vipPortStart=22 vipUuid=433769b59a7c42199d762af01e08ec16 protocolType=TCP vmNicUuid=4b9c27321b794679a9ba8c18239bbb0d

A unattached rule can be attached to a VM nic later.

Parameters ¶

Name	Description	Optional	Choices	Since
name	resource name, see Resource Properties			0.6
resourceUuid	resource uuid, see Create Resources	true		0.6
description	resource description, see Resource Properties	true		0.6
vipUuid	VIP UUID			0.6
vipPortStart	the start port of VIP		1 - 65535	0.6
vipPortEnd	the end port of VIP; if omitted, it’s set to vipPortStart.	true	1 - 65535	0.6
privatePortStart	the start port of guest IP (VM nic’s IP); if omitted, it’s set to vipPortStart	true	1 - 65535	0.6
privatePortEnd	the end port for guest IP (VM nic’s IP); if omitted, it’s set to vipPortEnd	true	1 - 65535	0.6
protocolType	network traffic protocol type		TCP UDP	0.6
vmNicUuid	uuid of VM nic this port forwarding rule will be attached to	true		0.6
allowedCidr	source CIDR; the port forwarding rule only applies to traffics having this source CIDR; if omitted, it’s set to 0.0.0.0/0	true		0.6

Delete Port Forwarding Rule ¶

Users can use DeletePortForwardingRule to delete a port forwarding rule. For example:

DeletePortForwardingRule uuid=310a6cd618144ca683d78d74307f16a4

The VIP is recycled for other network services to use, if no more port forwarding rules bound to it.

Parameters ¶

Name	Description	Optional	Choices	Since
deleteMode	see Delete Resources	true	Permissive Enforcing	0.6
uuid	rule uuid			0.6

Attach Port Forwarding Rule ¶

Users can use AttachPortForwardingRule to attach a rule to a VM nic. For example:

AttachPortForwardingRule ruleUuid=310a6cd618144ca683d78d74307f16a4 vmNicUuid=4b9c27321b794679a9ba8c18239bbb0d

Parameters ¶

Name	Description	Optional	Choices	Since
ruleUuid	rule uuid			0.6
vmNicUuid	VM nic uuid			0.6

Detach Port Forwarding Rule ¶

Users can use DetachPortForwardingRule to detach a rule from a VM nic. For example:

DetachPortForwardingRule uuid=310a6cd618144ca683d78d74307f16a4

Parameters ¶

Name	Description	Optional	Choices	Since
uuid	rule uuid			0.6

Query Port Forwarding Rule ¶

Users can use QueryPortForwardingRule to query rules. For example:

QueryPortForwardingRule vipPortStart=22 vipIp=17.200.20.6

QueryPortForwardingRule vmNic.l3Network.name=database-tier

Primitive Fields ¶

see port forwarding rule inventory

Nested And Expanded Fields ¶

Field	Inventory	Description	Since
vip	VIP inventory	VIP this rule is bound	0.6
vmNic	VM nic inventory	VM nic this rule is attached	0.6

Global Configurations ¶

snatInboundTraffic ¶

Name	Category	Default Value	Choices
snatInboundTraffic	portForwarding	false	true false

Whether to source NAT inbound traffic of a port forwarding rule. If true, the traffics reaching portForwardingRule.guestIp will have a source IP equal to portForwardingRule.vipIp; this is useful when a VM has multiple port forwarding rules attached; it forces a VM to reply incoming traffics through VIPs where traffics come from, rather than replying through the default route.

Tags ¶

Users can create user tags on a port forwarding rule with resourceType=PortForwardingRuleVO. For example:

CreateUserTag resourceType=PortForwardingRuleVO tag=ssh-rule resourceType=e960a93b7f974690bb779808f3c12a33