long id = getRouterId(network, isVpc);
String routerName = getRouterName(isVpc, id);
String accountIdStr = getAccountUuid(network);
// Add interior port on bridge side
BridgePort bridgePort = netBridge.addInteriorPort().create();
// Add interior port on router side, with network details
RouterPort routerPort = netRouter.addInteriorRouterPort();
String cidr = network.getCidr();
String cidrSubnet = NetUtils.getCidrSubNet(cidr);
int cidrSize = (int) NetUtils.getCidrSize(NetUtils.cidr2Netmask(cidr));
routerPort.networkAddress(cidrSubnet);
routerPort.networkLength(cidrSize);
routerPort.portAddress(network.getGateway());
// If this is a VPC, then we will be using NetworkACLs, which is
// implemented via chains on the router port to that network.
if (getIsVpc(network)) {
// Create ACL filter chain for traffic coming INTO the network
// (outbound from the port
int pos = 1;
RuleChain inc = api.addChain()
.name(getChainName(String.valueOf(network.getId()),
routerName,
RuleChainCode.ACL_INGRESS))
.tenantId(accountIdStr)
.create();
// If it is ARP, accept it
inc.addRule().type(DtoRule.Accept)
.dlType(0x0806)
.position(pos++)
.create();
// If it is ICMP to the router, accept that
inc.addRule().type(DtoRule.Accept)
.nwProto(SimpleFirewallRule.stringToProtocolNumber("icmp"))
.nwDstAddress(network.getGateway())
.nwDstLength(32)
.position(pos++)
.create();
// If it is connection tracked, accept that as well
inc.addRule().type(DtoRule.Accept)
.matchReturnFlow(true)
.position(pos++)
.create();
inc.addRule().type(DtoRule.Drop)
.position(pos)
.create();
//
RuleChain out = api.addChain()
.name(getChainName(String.valueOf(network.getId()),
routerName,
RuleChainCode.ACL_EGRESS))
.tenantId(accountIdStr)
.create();
// Creating the first default rule here that does nothing
// but start connection tracking.
out.addRule().type(DtoRule.Accept)
.matchForwardFlow(true)
.position(1)
.create();
routerPort.outboundFilterId(inc.getId());
routerPort.inboundFilterId(out.getId());
}
routerPort.create();
// Link them up
bridgePort.link(routerPort.getId()).update();
// Set up default route from router to subnet
netRouter.addRoute().type("Normal").weight(100)
.srcNetworkAddr("0.0.0.0").srcNetworkLength(0)
.dstNetworkAddr(cidrSubnet).dstNetworkLength(cidrSize)