Hi @stgraber , thank you for your quick reply! I would like a little more help if you are willing… Here are my thoughts:
- I have searched the entire internet, and I cannot find a single example of an “incus network acl rule add …” command so that I can see what the [properties…] might look like and what my options are.
- If I understood you correctly, I would need to specify (or programmatically find) the subnet IP space for both v4 and v6 for the newly created bridge so that I could create the appropriate acl deny statements.
- Would you kindly create example ‘acl create …’ and ‘acl add …’ statements so that I may better understand your recommendation? I am happy to sponsor your efforts.
Let’s assume a newly created incus instance with incusbr0.
Let’s assume I created a new bridge network using: incus network create incusbr1
The following is what was created: incus network show incusbr1
config:
ipv4.address: 10.52.28.1/24
ipv4.nat: "true"
ipv6.address: fd42:903d:e8fa:756e::1/64
ipv6.nat: "true"
description: ""
name: incusbr1
type: bridge
used_by:
- /1.0/instances/delme-03-br1
managed: true
status: Created
locations:
- none
I can create the network acl using: incus network acl create incusbr1-acl-01
I have no idea how to finish this statement to add a rule: incus network acl rule add incusbr1-acl-01 ingress [properties…]
Once the rules are added, you can set the acl to the new bridge network: incus network set incusbr1 security.acls=“incusbr1-acl-01”
Thank you for your time and consideration! Chuck