Hi TNSR Community,
I’m exploring the best ways to configure Access Control Lists (ACLs) in TNSR to secure a containerized webserver exposed through the dataplane, and I’d love to hear your approaches for robust setups.
Details:
Setup: TNSR (v25.02, Home+Lab ISO), Ubuntu 22.04, deployed on bare metal with VPP and DPDK, running a containerized nginx webserver (port 80) via Docker.
Context: I’m exposing the webserver through the TNSR dataplane, following the VPP nginx example (https://docs.netgate.com/tnsr/en/latest/usecases/nginx.html).
Observation: The ACL allows HTTP traffic, but I’m concerned about potential vulnerabilities like packet fragmentation attacks or unintended access from other ports. The TNSR ACL docs (https://docs.netgate.com/tnsr/en/latest/acl/index.html) mention basic filtering but lack details on advanced protections.
Steps Tried:
Applied the ACL to the dataplane interface (GigabitEthernet0/0/0) via TNSR CLI and verified with show acl.
Tested connectivity with curl from an external client, confirming HTTP access.
Checked /var/log/vnet.log for ACL drops, but no clear indicators of fragmentation issues.
Reserved CPU cores for TNSR/DPDK to avoid resource contention with Docker, per community suggestions.
Goal: Secure the webserver with a robust ACL setup that minimizes attack surfaces while maintaining performance.
Questions:
What are your recommended best practices for configuring TNSR ACLs to secure containerized apps (e.g., nginx) on the dataplane?
How do you handle protection against packet fragmentation attacks or other advanced threats with TNSR ACLs? Are they equivalent to VPP ACLs?
Any tips for logging or debugging ACL rules to ensure only intended traffic is allowed?
For those running similar setups, how do you balance ACL granularity with TNSR’s high-performance routing?
I’d appreciate any insights or configurations you’ve found effective for securing webserver traffic! Thanks in advance.
