Applicable scenario

• Product: ZCF
• Component: Cloud
• Version: 4.8.x
• Deployment topology: dual management nodes
• Trigger: A vulnerability scan reports that Traceroute probes are permitted and host-side rules are required to restrict related ICMP probe traffic.

Symptoms

• A vulnerability scan reports a risk that permits Traceroute probes.
• Only authorized network segments must be allowed; specified ICMP traffic from other sources must be blocked.
• The change applies only to physical-host firewall rules.

Determination method

1. Confirm the allowed network segment list before the change.
2. After configuration, check for ipset and iptables rules.
3. Use tracert to validate the remediation.

Cause

The host does not restrict the related probe traffic. Use an ipset whitelist and iptables rules to allow authorized segments and drop ICMP type 8 traffic from other sources.

Resolution

1. Preparation

• Risk level: low.
• Disable global VM HA.
• Back up databases on both management nodes.
• Process one physical host at a time and roll out only after each host has no exception.

2. Back up the database:

   zstack-ctl dump_mysql
   zstack-ctl dump_mysql

• Expected result: Backups of both management-node databases are complete.

3. Create the allowed IP set:

   ipset create ZS-ALLOW-IP-ICMP hash:net -exist
   ipset flush ZS-ALLOW-IP-ICMP

• Expected result: The whitelist set is initialized.

4. Add the allowed network segment:

   ipset add ZS-ALLOW-IP-ICMP xx.xx.xx.xx/xx

• Expected result: The authorized segment is added to the whitelist.

5. Check the whitelist set:

   ipset list ZS-ALLOW-IP-ICMP

• Expected result: Allowed segments are present.

6. Add the blocking rule:

   iptables -A INPUT -t mangle -p icmp --icmp-type 8 -m set ! --match-set ZS-ALLOW-IP-ICMP src -m comment --comment ZS-SAFE-CONFIGURATION -j DROP

• Expected result: ICMP type 8 requests outside the whitelist are dropped.

7. Check that the rule takes effect:

   iptables -nvL | grep icmptype

• Expected result: The rule appears in the firewall table.

8. Save configuration:

   ipset save > /etc/sysconfig/ipset
   service iptables save

• Expected result: Rules persist after restart.

9. Validate:

   tracert $IP

• Expected result: Probe behavior matches expectations.

10. After one-host validation has no exception, configure remaining physical-host nodes one by one.
11. Enable global VM HA.

• Expected result: Remediation is complete and the platform resumes normal operation.

Verification

• ipset list ZS-ALLOW-IP-ICMP is correct.
• The rule exists in iptables -nvL.
• tracert output matches expectations.
• The platform and services run normally.

Risks and rollback

• Risk: An incomplete whitelist can block legitimate traffic.
• Risk level: low.
• Rollback:

  iptables -D INPUT -t mangle -p icmp --icmp-type 8 -m set ! --match-set ZS-ALLOW-IP-ICMP src -m comment --comment ZS-SAFE-CONFIGURATION -j DROP
  ipset save > /etc/sysconfig/ipset
  service iptables save