Network ACLs on the RVM Service

Egress

Strong, default-deny, access control limits (ACLs) have been implemented on the RVM Service. These ACLs operate at the network level (i.e., are separate and distinct from the VM firewall).

The ACLs:

• permit access to most ports/protocols at IP addresses located off-campus;
• deny access to most ports/protocols at IP addresses located within the data centre. (Only NTP, DNS, SMTP/email, CIFS/NFS and LDAP, to appropriate servers, is permitted.)

This policy is required so that nominated people from academic research groups may have administrator/root access to VMs.

Ingress

RVMs are generally accessible from campus on the usual ports. They are not, however, as easily accessible from the VPN; see our entry on the subject. External access to VMs without a VPN is currently only allowed over HTTP(S): please get in touch with us.

Requesting an exception

Depending on where the ACLs are enforced, an IT4IT ticket must be filled either with Linux/Unix Server Management (if at VMware level), Firewall Management (if at Palo Alto level), Network System Management (rarely, if the block occurs at VLAN level), Network Load Balancer Management (if the block is enforced at the F5 level) or any combination of the above.

A Firewall Rule Change form also exists: it is mostly intended in an attempt to simplify this process but won’t be suitable if the rule is enforced in VMware or the F5. IT Security and third-parties related to your demand might have to get involved at different stage of your journey. Do get in touch with us before you embark on it.