So far, we've looked at some common basic network architectures and even managed to build some virtual networks and routers of our own along the way. But what about security? You'll be happy to know that Neutron does its best to protect you from yourself and other users out of the box, but like many things, some tweaking and coordination may be involved in order to provide a strong security posture for instances and the applications hosted within them.
Neutron includes two methods of providing network-level security to instances: security groups and virtual firewalls. Security group functionality predates Neutron and provides traffic filtering at the individual virtual network interface level on compute nodes using iptables. Virtual firewalls, on the other hand, are provided by the advanced Neutron service known as Firewall as a Service (FWaaS), which relies on iptables to filter traffic at the perimeter of the network within a Neutron router. In either...