acl scenerio

[zurrehma]

i have created this scenario in vpp from vpp-agent and now want to apply acl policy on vpp tap interface in above scenario such that only ns0 can ping ns2. How i can do that?

[milanlenco]

Simply attach ACL on the egress side of the VPP TAP interface connecting ns2 namespace, containing 3 rules (in this order):

1. allow any traffic from ns0
2. block any/ICMP traffic from 10.0.0.0/24 range (bridge domain)
3. allow any traffic (override default deny rule)

Here is an example that you can try: https://github.com/milanlenco/vpp-agent/blob/acl-scenario/examples/acl_scenario/main.go
The ACL itself is here: https://github.com/milanlenco/vpp-agent/blob/acl-scenario/examples/acl_scenario/main.go#L289-L334
In the example everything from ns1 going towards ns2 is blocked. If you only want to block the ICMP traffic (and keep TCP/UDP allowed), un-comment this: https://github.com/milanlenco/vpp-agent/blob/acl-scenario/examples/acl_scenario/main.go#L309-L321