Clarify ACL-Rule Behaviour for TCP/UDP-Protocol without start- and endport
- Dominant language
- Java
- Stars
- 3.1k
- Forks
- 1.4k
- Avg merge
- 6d 19h
- Merged PRs (30d)
- 32
Description
### Discussed in https://github.com/apache/cloudstack/discussions/13113
Originally posted by **mwaag** May 7, 2026
Hi,
we noticed cloudstack let you successfully define ACL-Ingress-Rules for TCP (and UDP) without setting a start- and endport.
Many of our users (even we) assumed, that it stands for 'all ports'. But instead the router keeps on blocking traffic.
(We didn't test this on UDP explicitly)
We know, we can workaround this with just setting start- and endports or use protocol: All
Is this expected behaviour or should this be handled as a bug?
(We probably would suggest to either restrict defining rules without setting start- and endports at all or treat this kind of rules as "all ports" - rule)
Tested Versions are:
4.18.2.4
4.20.3.0
Contributor guide
Research direction
Start with the linked discussion at https://github.com/apache/cloudstack/discussions/13113, including the reported behavior on CloudStack 4.18.2.4 and 4.20.3.0. No source file or test is named, so locate the ACL ingress handling for TCP and UDP rules without start- or endports. Done means the behavior is explicitly defined and either restricted or handled consistently as an all-ports rule, with coverage for both protocols.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100