1.环境,两台虚拟机(两台虚拟机绑定交换机acl_sw)
acl_v1 内部IP:24.130.26.124 外部ip:10.67.2.34 接口名:mnet2
acl_v2 内部IP:24.130.26.251 外部ip:10.67.2.33 接口名:mnet1
2.虚拟机之间不互通,但虚拟机允许特定IP机器SSH它
#阻止所有到acl_v1、acl_v2的流量
ovn-nbctl acl-add acl_sw to-lport 0 'outport == "mnet2" && ip' drop
ovn-nbctl acl-add acl_sw to-lport 0 'outport == "mnet1" && ip' drop
#允许与网关通信(out-lr路由器连到acl_sw交换机上的网卡接口ip)
ovn-nbctl acl-add acl_sw to-lport 1000 'outport == "mnet2" && ip4.src == 24.130.26.1/32' allow-related
ovn-nbctl acl-add acl_sw to-lport 1000 'outport == "mnet1" && ip4.src == 24.130.26.1/32' allow-related
#只允许10.67.1.154 可以访问
ovn-nbctl acl-add acl_sw to-lport 1000 'outport == "mnet2" && ip4.src == 10.67.1.154/32' allow-related
ovn-nbctl acl-add acl_sw to-lport 1000 'outport == "mnet1" && ip4.src == 10.67.1.154/32' allow-related
3.还原,虚拟机之间可以互通
ovn-nbctl acl-del acl_sw