Learning OpenStack Networking - Third Edition

Stepping through the chains

The implementation of security group rules using iptables is similar in both Linux bridge and Open vSwitch-based environments. On compute01, a compute node running the Linux bridge agent and hosting the instance in this example, shows that iptables rules applied by the Neutron agent can be observed using the iptables-save or iptables -L commands.

For readability, only the raw and filter tables of rules related to the instance are shown in the following screenshot. Some comments have been removed or truncated to fit the page:

First, the PREROUTING chain of the raw table is consulted. In the PREROUTING chain, we can ...