digitalocean / digitalocean/api-v2

Cannot create a firewall/various outbound rules via terraform with port_range "all" specified in outbound rule config

Open
#166 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
138
Forks
16
PR merge metrics
No merged PRs in 30d

Description

hi there - i tried to launch a firewall from terraform, but it doesn't really work yet 100%. terraform's documentation basically copies digitalocean's documentation verbatim, which states that the use of ```port_range``` is optional, and that ```all``` can be used to include all ports.

the api docs state this should be possible: [https://developers.digitalocean.com/documentation/v2/#add-rules-to-a-firewall](url)

the only way i could get it to work (creating a digitalocean firewall from scratch using terraform), was to setup the firewall config as you would normally (using ```all``` *does* work for ```port_range``` on inbound rules). comment out the entire ```outbound_rule``` block. run ```terraform plan``` then ```terraform apply``` and it will create the firewall.

here's the hcl that i'm using to create the firewall with terraform.

```
resource "digitalocean_firewall" "fwtest" {
name = "fwtest"
droplet_ids = []
tags = []

inbound_rule = [
{
protocol = "tcp"
port_range = "80"
source_addresses = ["1.2.3.4/32"]
},
{
protocol = "tcp"
port_range = "443"
source_addresses = ["1.2.3.4/32"]
},
{
protocol = "tcp"
port_range = "all"
source_addresses = ["1.2.3.4/32"]
}
]

/* outbound_rule = [
{
protocol = "icmp"
port_range = "0"
destination_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "tcp"
port_range = "0"
destination_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "udp"
port_range = "0"
destination_addresses = ["0.0.0.0/0", "::/0"]
}
] */
}
```

next, add the three outbound rules from the digitalocean web console.

![digitalocean_api_firewall_issues](https://user-images.githubusercontent.com/3210577/31045053-2b27696e-a5a1-11e7-8f77-a0e728d5feab.png)

now **uncomment** the ```outbound_rule``` block and run ```terraform refresh```. also worth noting - any inbound rules created from terraform using ```port_range = "all"``` will need to be **changed back** to ```port_range = "0"``` in order to make terraform happy.

if your outbound rules are setup like the hcl config here, ```terraform plan``` should now be green with no changes to be made.

so something is not quite right when adding rules via the api with the use of "all" to give sources/tags full access to whatever the protocol specified.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.