Using VM Networking and Security

1: Associate an IP Address with an Instance

2: Release an IP Address

3: Create a Security Group

4: Delete a Security Group

5: Authorize Security Group Rules

6: Revoke Security Group Rules

Using VM Networking and Security

The Eucalyptus networking mode used, and it’s configuration, determine the features available to users; such as elastic IPs, which are public (external) IP addresses that users can reserve and dynamically associate with VM instance; and security groups, which are sets of firewall rules applied to VM instances associated with the group.

Euca2ools or the AWS CLI provide means for users to interact with these features with commands for allocating and associating IP addresses, as well as creating, deleting, and modifying security groups.

1 - Associate an IP Address with an Instance

To associate an IP address with an instance:

Allocate an IP address:

euca-allocate-address ADDRESS <IP_address>

Associate the allocated IP address with an instance ID:

euca-associate-address -i <instance_ID> <IP_address> 



euca-associate-address -i i-56785678 192.168.17.103

2 - Release an IP Address

Use euca-disassociate-address and euca-release-address to disassociate an IP address from an instance and to release the IP address to the global pool, respectively.

To release an IP address:

Enter the following command to disassociate an IP address from an instance:

euca-disassociate-address <IP_address>

Enter the following command to release an IP address:

euca-disassociate-address <IP_address>

The following example releases the IP address, 192.168.17.103

euca-release-address 192.168.17.103

3 - Create a Security Group

Security groups let you control network access to instances by applying network rules to instances associated with a group.

To create a security group:

Enter the following command:

euca-add-group -d <description> <group_name>

Note

You can also create a security group you run an instance. Use the command with the option. Security group rules only apply to incoming traffic thus all outbound traffic is permitted.

The following example creates a new security group named mygroup and described as newgroup .

euca-add-group -d "newgroup" mygroup

4 - Delete a Security Group

The euca-delete-group command lets you delete security groups. To delete a security group:

Enter the following command:

euca-delete-group <group_name>

The following example deletes the security group, mygroup .

euca-delete-group mygroup

5 - Authorize Security Group Rules

By default, a security group prevents incoming network traffic from all sources. You can modify network rules and allow incoming traffic to security groups from specified sources using the euca-authorize command.

To authorize security group rules:

Use euca-authorize to authorize port 22 access to your default group. Enter the following command:

euca-authorize -P <protocol> -p <port_number> \
-s <CIDR_source_network> <group_name>

The following example allows all incoming SSH traffic on port 22 to access to the security group mygroup . The CIDR source network, 0.0.0.0/0 , refers to any source.

euca-authorize -P tcp -p 22 -s 0.0.0.0/0 mygroup 
 GROUP	mygroup ↵
 PERMISSION	mygroup	ALLOWS	tcp	22	22	FROM	CIDR

Instead of specifying a CIDR source, you can specify another security group. The following example allows access to the security group mygroup from the someothergroup security group using SSH on port 22.

euca-authorize --source-group someothergroup \
--source-group-user someotheruser -P tcp -p 22 mygroup

6 - Revoke Security Group Rules

To revoke security group rules:

Enter the following command:

euca-revoke -P <protocol> -p <port_number> -s <CIDR_source_network> <group_name>

The following example revokes the network rules authorized for the security group mygroup .

euca-revoke -P tcp -p 22 -s 0.0.0.0/0 mygroup