Components · Networking

Neutron-FWaaS

Firewall groups, policies and rules (FWaaS v2).

Go OVN ACLsopenkeel-neutron-fwaas

The module

OpenKeel implementation in Go of OpenStack neutron-fwaas (neutron-fwaas-api), generated from the reverse-specification of branch stable/2026.2 by the generate-go-from-spec skill. It serves the FWaaS v2 API (/v2.0/fwaas) and programs firewall groups as OVN Port_Groups and stateless ACLs, replacing the firewall_v2 service plugin and its OVN driver: same routes, status codes, error bodies and policies, same NB rows. It runs beside openkeel-neutron, on its database and its OVN; clients reach it through a proxy in openkeel-neutron: see docs/NEUTRON-INTEGRATION.md. What is reproduced and what differs is in docs/CONFORMANCE.md; the security checklist is in docs/SECURITY.md.

Go module: github.com/openkeel/openkeel-neutron-fwaas
Binary: neutron-fwaas-api (API on port 9696, health and metrics on 9090)
Configuration: YAML, see config/config.example.yaml
Setting up a development environment, the database and the tests: docs/GETTING-STARTED.md
Database schema, migrations and upgrades: docs/DATABASE.md

Excerpt from openkeel-neutron-fwaas/README.md (in English).

REST API

23 operations of the original REST API (routes and body actions), and their state in OpenKeel.

23Implemented

See every operation

How compatibility is tested

Re-recorded Python FWaaS tests are replayed against the Go service, and the OVN driver is compared step by step with the real Python driver on a real Northbound.

Replay of recorded exchanges

E2E replay of re-recorded tests

691 exchanges of 135 Python tests, re-recorded with each request's identity, give the same answers.

How it runs

make e2e-strict, on go-mysql-server and on MariaDB 11.4.

Latest result 689 / 691 (2026-10-31); the 2 differences are a path outside the extension, 404 in both.

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Differential test

Differential with the Python driver

The same steps give the same status, group status and every column of Port_Group and ACL rows as neutron-fwaas with ovsdbapp.

How it runs

make ovn-test, test/ovn/differential, on a real Northbound.

Latest result 47 / 47 steps identical (2026-10-31).

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Unit and golden tests

OVN ACL and validator vectors

ACLs match the original function byte for byte; converters and validators match the real neutron-lib.

How it runs

internal/ovnfw/acl_test.go; tools/gen_validator_vectors.py and internal/fwaas/attrs_test.go.

Latest result 935 / 935 ACL vectors; 97 / 97 validator vectors (2026-10-31).

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Concurrency on Galera

Concurrency on MariaDB Galera

Quotas, rule insertion, default groups and ports hold through three nodes.

How it runs

test/galera on a 3-node cluster, quota and insert_rule writes through one node.

Latest result 4 tests pass, 3 runs out of 3. Open finding: multi-node read-modify-write lost updates in 3 % to 18 % of runs.

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

End to end on a lab

Lab install through Neutron

Token, extension, firewall group ACTIVE, ACLs in the Northbound, error bodies and cleanup, all through Neutron's endpoint.

How it runs

okadm install --mode lab --components neutron-fwaas on kind.

Latest result Passes (2026-10-31); the lab has no data plane, no packet was filtered.

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Tempest

neutron-tempest-plugin fwaas

The upstream FWaaS API and scenario tests.

How it runs

Needs a cloud with a data plane.

Latest result Not run.

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Left out of the rewrite

FWaaS v2 keeps its API on the OVN driver only, so the agent path with iptables, conntrack and NFLOG, the plugin loader and the manual sync tool are gone.

Done by the Cloud Native platform

Agent driver, iptables, conntrack and NFLOG

Taken over by OVN

Why it was left out

Firewall rules are OVN ACLs and Port_Groups written by the service; the L2 and L3 agent extensions and their RPC topics are not needed on OVN.

Why the solution is not affected

Firewall groups apply to router ports as on Python's OVN driver; VM ports are refused (409) there too. NFLOG network logging is not available.

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Internal machinery simplified

Manual neutron-ovn-db-sync-util

Why it was left out

A reconcile loop (300 s, one replica by OVSDB lock) removes stale ACLs and recreates missing ones.

Why the solution is not affected

OVN converges without operator action; the API is unchanged.

Source: openkeel-neutron-fwaas/docs/CONFORMANCE.md

Internal machinery simplified

service_plugins loading inside neutron-server

Taken over by Kubernetes Deployments

Why it was left out

FWaaS is its own Deployment; openkeel-neutron proxies /v2.0/fwaas to it and advertises fwaas_v2.

Why the solution is not affected

Clients call the same Neutron endpoint and paths.

Source: openkeel-neutron-fwaas/config/dropped-options.md

Only what was left out by design is listed here; the work not done yet is in the Known gaps of the module's docs/CONFORMANCE.md. Every module

Neutron-FWaaS interactions

Service view generated by the diagram skill from the OpenKeel model.

The 2 interactions of the model

From	To	Protocol	What
Neutron server	Neutron FWaaS	REST API	proxy /v2.0/fwaas/*, same token
Neutron FWaaS	OVN Northbound DB	OVSDB	pg_* Port_Groups, stateless ACLs

Specifications

Services

neutron-fwaas

Branch stable-2026.2 · 8 files

Read the reverse-spec

Also in Networking

Neutron

Networks, subnets, ports, routers and security groups written to the OVN Northbound database; IPv4 and IPv6.

GoOVN and Open vSwitch

Octavia (OVN)

The Octavia v2 API served by neutron-api; OVN load balancers, enabled by default.

GoOVN load balancers

Neutron-VPNaaS

Site-to-site IPsec VPN: IKE, IPsec policies, connections.

GoIPsec agent

OVN-BGP-Agent

Announces over BGP the VM and floating IPs reachable through the node.

GoFRR and OVN