</p>
</column>
+ <column name="type">
+ <p>
+ Specify a type for this logical port. Logical ports can be used to model
+ other types of connectivity into an OVN logical switch. Leaving this column
+ blank maintains the default logical port behavior.
+ </p>
+
+ <p>
+ When this column is set to <code>localnet</code>, this logical port
+ represents a connection to a locally accessible network from each
+ <code>ovn-controller</code> instance. A logical switch can only have a
+ single <code>localnet</code> port attached and at most one regular
+ logical port. This is used to model direct connectivity to an existing
+ network.
+ </p>
+ </column>
+
+ <column name="options">
+ <p>
+ This column provides key/value settings specific to the logical port
+ <ref column="type"/>.
+ </p>
+
+ <p>
+ When <ref column="type"/> is set to <code>localnet</code>, you must set
+ the option <code>network_name</code>. <code>ovn-controller</code> uses
+ local configuration to determine exactly how to connect to this locally
+ accessible network.
+ </p>
+ </column>
+
<column name="parent_name">
When <ref column="name"/> identifies the interface of a container
spawned inside a tenant VM, this column represents the VM interface
</p>
<column name="priority">
- The ACL rule's priority. Rules with numerically higher priority take
- precedence over those with lower. If two ACL rules with the same
- priority both match, then the one actually applied to a packet is
- undefined.
+ <p>
+ The ACL rule's priority. Rules with numerically higher priority
+ take precedence over those with lower. If two ACL rules with
+ the same priority both match, then the one actually applied to a
+ packet is undefined.
+ </p>
+
+ <p>
+ Return traffic from an <code>allow-related</code> flow is always
+ allowed and cannot be changed through an ACL.
+ </p>
+ </column>
+
+ <column name="direction">
+ <p>Direction of the traffic to which this rule should apply:</p>
+ <ul>
+ <li>
+ <code>from-lport</code>: Used to implement filters on traffic
+ arriving from a logical port. These rules are applied to the
+ logical switch's ingress pipeline.
+ </li>
+ <li>
+ <code>to-lport</code>: Used to implement filters on traffic
+ forwarded to a logical port. These rules are applied to the
+ logical switch's egress pipeline.
+ </li>
+ </ul>
</column>
<column name="match">
- The packets that the ACL should match, in the same expression
- language used for the <ref column="match" table="Pipeline"
- db="OVN_Southbound"/> column in the OVN Southbound database's <ref
- table="Pipeline" db="OVN_Southbound"/> table. Match
- <code>inport</code> and <code>outport</code> against names of
- logical ports within <ref column="lswitch"/> to implement ingress
- and egress ACLs, respectively. In logical switches connected to
- logical routers, the special port name <code>ROUTER</code> refers
- to the logical router port.
+ <p>
+ The packets that the ACL should match, in the same expression
+ language used for the <ref column="match" table="Logical_Flow"
+ db="OVN_Southbound"/> column in the OVN Southbound database's
+ <ref table="Logical_Flow" db="OVN_Southbound"/> table. The
+ <code>outport</code> logical port is only available in the
+ <code>to-lport</code> direction (the <code>inport</code> is
+ available in both directions).
+ </p>
+
+ <p>
+ By default all traffic is allowed. When writing a more
+ restrictive policy, it is important to remember to allow flows
+ such as ARP and IPv6 neighbor discovery packets.
+ </p>
+
+ <p>
+ In logical switches connected to logical routers, the special
+ port name <code>ROUTER</code> refers to the logical router port.
+ </p>
</column>
<column name="action">
<li>
<code>reject</code>: Drop the packet, replying with a RST for TCP or
ICMP unreachable message for other IP-based protocols.
+ <code>Not implemented--currently treated as drop</code>
</li>
</ul>
-
- <p>
- Only <code>allow</code> and <code>drop</code> are implemented:
- <code>allow-related</code> is currently treated as <code>allow</code>,
- and <code>reject</code> as <code>drop</code>.
- </p>
</column>
<column name="log">
Each row represents one L3 logical router.
</p>
+ <column name="name">
+ <p>
+ A name for the logical router. This name has no special meaning or purpose
+ other than to provide convenience for human interaction with the ovn-nb
+ database. There is no requirement for the name to be unique. The
+ logical router's UUID should be used as the unique identifier.
+ </p>
+ </column>
+
<column name="ports">
The router's ports. This is a set of weak references, so a <ref
table="Logical_Switch"/> must also refer to any given <ref
table="Logical_Router_Port"/> or it will automatically be deleted.
</column>
- <column name="ip">
- The logical router's own IP address. The logical router uses this
- address for ICMP replies (e.g. network unreachable messages) and other
- traffic that it originates and responds to traffic destined to this
- address (e.g. ICMP echo requests).
- </column>
-
<column name="default_gw">
IP address to use as default gateway, if any.
</column>
the router port.
</p>
+ <column name="name">
+ <p>
+ A name for the logical router port. This name has no special meaning or purpose
+ other than to provide convenience for human interaction with the ovn-nb
+ database. There is no requirement for the name to be unique. The
+ logical router port's UUID should be used as the unique identifier.
+ </p>
+ </column>
+
<column name="network">
- The IP network and netmask of the network on the router port. Used for
- routing.
+ The IP address of the router and the netmask. For example,
+ <code>192.168.0.1/24</code> indicates that the router's IP address is
+ 192.168.0.1 and that packets destined to 192.168.0.<var>x</var> should be
+ routed to this port.
</column>
<column name="mac">
projects / cascardo / ovs.git / blobdiff