Repository navigation
CS4.22.0 vROUTER ACLs Feature is non RFC compliant applied to Internal Interface #13266
Description
problem
CS 4.22.0
Host Ubuntu 22.4 KVM
vRouter on VPC ACLs
This VPC ACL feature is beyond good, it's awesome. However @weizhouapache with all the love I have for the team. That's not right, ACL should be applied to the edge - and we know that should not be to interpretation, and many think are just Cisco best practices - we should have a feature to select WAN-side, LAN-side or named Edge-side, Internal-Side which seems are more contemporary names.
- RFC 2827
- RFC 3704
Suggestion: if decided to make it RF-ish. To make easy the transition for existing systems, the updated feature will apply to LAN-side (internal-side) by default.
versions
CS 4.22.0
Host Ubuntu 22.4 KVM
running vRouter with 8CPUs and 8GRAM, oversubscription is 1:1 for all systems.
The steps to reproduce the bug
- Create a VPC
- Add the custom ACL with ingress only
- the ACL does not filter the traffic, as is applied to the vRouter LAN AKA Internal interface.
What to do about it?
No response
Activity
weizhouapache commentedon May 27, 2026
@tatay188
can you give some examples of step2 and step3 ?
tatay188 commentedon May 27, 2026
Step 2: example:
<style> </style>tatay188 commentedon May 27, 2026
Step-3:
I can see the traffic from those blocked IP addresses.
There is an Obvious Workaround - Use Egress instead of Ingress - In my case I decided to use Paloalto VNF.
IF change to Egress it should Block them; However, this should be applied to the edge interface/Wan-interface.
Or Give the end User to select Which interface to apply to the ACL.
weizhouapache commentedon May 27, 2026
@tatay188
thanks for the info, I will try to reproduce the issue
weizhouapache commentedon Jun 24, 2026
@tatay188
#12706 is probably you asked for.
tatay188 commentedon Jun 24, 2026
@weizhouapache It Seems like, I am certainly eager to test it.
DaanHoogland commentedon Jul 22, 2026
@tatay188 , did #12706 solve your use-case?
tatay188 commentedon Jul 22, 2026
the #12706is still in tests on your side, and I have to build a new full test system for my side - I cant push the change ona production environment.
DaanHoogland commentedon Jul 24, 2026
no hurries, but close at will
github-actions commentedon Aug 19, 2026
🎯 Triage report
The reporter wants VPC ACLs to be applicable to the WAN/edge (public) side of the virtual router rather than only the internal/LAN side, aligning with common firewall conventions (RFC 2827/3704). A maintainer already pointed at PR #12706 as a likely solution and the reporter has not yet confirmed whether it resolves their use case.
📊 Assessment
🔗 Similar issues
💡 Notes and suggestions
A maintainer already asked the reporter (2026-07-22) whether PR #12706 solves the use case, and the reporter indicated they still need to build a test environment to verify. This issue may be closable once that verification is confirmed — a maintainer should follow up.
Add this agentic workflows to your repo
To install this agentic workflow, run