负载均衡支持黑名单和白名单两种功能，白名单功能可以仅允许指定IP地址请求业务，黑名单功能可以阻止指定IP地址请求业务。本场景以白名单为例，介绍如何使用CLI实现负载均衡访问流量过滤。

1. 使用zstack-cli创建ACL组。

   admin >>>CreateAccessControlList name=white_list ipVersion=4
   {
       "inventory": {
           "createDate": "Jul 9, 2020 2:55:32 PM",
           "entries": [],
           "ipVersion": 4,
           "lastOpDate": "Jul 9, 2020 2:55:32 PM",
           "name": "white_list",
           "uuid": "b01e0cb4deaf4edd86778942d9e9e5c2"
       },
       "success": true
       }

2. 使用zstack-cli添加IP地址条目到ACL组。

   admin >>>AddAccessControlListEntry aclUuid=b01e0cb4deaf4edd86778942d9e9e5c2 entries=10.0.0.1 description='white test'
   {
       "inventory": {
           "aclUuid": "b01e0cb4deaf4edd86778942d9e9e5c2",
           "createDate": "Jul 9, 2020 3:05:42 PM",
           "description": "white test",
           "ipEntries": "10.0.0.1",
           "lastOpDate": "Jul 9, 2020 3:05:42 PM",
           "uuid": "1cdc96491dd14d27a236f98c7eabae21"
       },
       "success": true
   }

3. 使用zstack-cli将ACL组添加到监听器并设置为白名单。

   admin >>>AddAccessControlListToLoadBalancer aclType=white aclUuids=b01e0cb4deaf4edd86778942d9e9e5c2 listenerUuid=78e84306bb604dd4b921592de2a60fb1
   {
       "inventory": {
           "aclRefs": [
               {
                   "aclUuid": "b01e0cb4deaf4edd86778942d9e9e5c2",
                   "createDate": "Jul 9, 2020 4:42:12 PM",
                   "id": 3,
                   "lastOpDate": "Jul 9, 2020 4:42:12 PM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "type": "white"
               }
           ],
           "certificateRefs": [],
           "createDate": "Jul 7, 2020 9:08:23 PM",
           "instancePort": 80,
           "lastOpDate": "Jul 8, 2020 10:17:32 AM",
           "loadBalancerPort": 80,
           "loadBalancerUuid": "bf3520cbb2314fe98416bd5cd982ebf9",
           "name": "VPC监听器",
           "protocol": "tcp",
           "uuid": "78e84306bb604dd4b921592de2a60fb1",
           "vmNicRefs": [
               {
                   "createDate": "Jul 8, 2020 9:54:34 AM",
                   "id": 4,
                   "lastOpDate": "Jul 8, 2020 9:54:34 AM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "status": "Active",
                   "vmNicUuid": "2e3814e26d364e2cbc4679e46ad51454"
               },
               {
                   "createDate": "Jul 8, 2020 9:54:34 AM",
                   "id": 6,
                   "lastOpDate": "Jul 8, 2020 9:54:34 AM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "status": "Active",
                   "vmNicUuid": "9aec86a02b4149f4b111a904cf89f4d1"
               },
               {
                   "createDate": "Jul 8, 2020 9:54:34 AM",
                   "id": 5,
                   "lastOpDate": "Jul 8, 2020 9:54:34 AM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "status": "Active",
                   "vmNicUuid": "6e612c3a80d047d9b46378fa38fcaf96"
               }
           ]
       },
       "success": true
       }

4. 使用zstack-cli开启ACL。

   admin >>>ChangeLoadBalancerListener aclStatus=enable uuid=78e84306bb604dd4b921592de2a60fb1
   {
       "inventory": {
           "aclRefs": [
               {
                   "aclUuid": "2884b4aeb83345b6884b7dbb3c2f66d5",
                   "createDate": "Jul 9, 2020 3:15:58 PM",
                   "id": 2,
                   "lastOpDate": "Jul 9, 2020 3:15:58 PM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "type": "white"
               },
               {
                   "aclUuid": "b01e0cb4deaf4edd86778942d9e9e5c2",
                   "createDate": "Jul 9, 2020 3:15:03 PM",
                   "id": 1,
                   "lastOpDate": "Jul 9, 2020 3:15:03 PM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "type": "white"
               }
           ],
           "certificateRefs": [],
           "createDate": "Jul 7, 2020 9:08:23 PM",
           "instancePort": 80,
           "lastOpDate": "Jul 8, 2020 10:17:32 AM",
           "loadBalancerPort": 80,
           "loadBalancerUuid": "bf3520cbb2314fe98416bd5cd982ebf9",
           "name": "VPC监听器",
           "protocol": "tcp",
           "uuid": "78e84306bb604dd4b921592de2a60fb1",
           "vmNicRefs": [
               {
                   "createDate": "Jul 8, 2020 9:54:34 AM",
                   "id": 6,
                   "lastOpDate": "Jul 8, 2020 9:54:34 AM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "status": "Active",
                   "vmNicUuid": "9aec86a02b4149f4b111a904cf89f4d1"
               },
               {
                   "createDate": "Jul 8, 2020 9:54:34 AM",
                   "id": 5,
                   "lastOpDate": "Jul 8, 2020 9:54:34 AM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "status": "Active",
                   "vmNicUuid": "6e612c3a80d047d9b46378fa38fcaf96"
               },
               {
                   "createDate": "Jul 8, 2020 9:54:34 AM",
                   "id": 4,
                   "lastOpDate": "Jul 8, 2020 9:54:34 AM",
                   "listenerUuid": "78e84306bb604dd4b921592de2a60fb1",
                   "status": "Active",
                   "vmNicUuid": "2e3814e26d364e2cbc4679e46ad51454"
               }
           ]
       },
       "success": true
   }

5. 使用curl命令验证白名单功能是否生效。
   预期结果：

   • 使用访问设备-1请求页面，无法请求到页面；
   • 使用访问设备-2请求页面，正常请求到页面。

   实际结果：

   [root@10.254.254.1 ~]# curl http://10.0.0.254
   curl: (56) Recv failure: Connection resert by peer
   [root@10.254.254.1 ~]# ssh root@10.0.0.1
   Last login: Thu Sep 17 19:08:35 2020 from 127.0.0.1
   [root@10.0.0.1 ~]# curl http://10.0.0.254
   web1

   用户使用非白名单内的IP地址10.254.254.1请求页面被阻止，使用白名单内的IP地址10.0.0.1请求页面成功。由此可见，白名单功能已生效。