tiCrypt

VM Access Rules

AdministratorRequires: Super-admin role to create, edit and delete rules. Users who can see a rule's VM configuration open and close its access.

A VM access rule lets the VMs started from chosen VM configurations reach one server, a domain name or an IPv4 address, on chosen ports over TCP or UDP. The rule is either Always allowed, so the VMs reach the server whenever they run, or Time-limited access, so the path stays closed until a user opens it for a number of minutes.

A VM access rule is not a global licensing server. A global licensing server opens its server to every VM in the deployment. A VM access rule opens its server only to the VMs of the VM configurations it names, and an explicit rule only while someone has opened it.

Why VM access rules exist

• VMs have no outbound access: tiCrypt blocks every path out of a secure VM, because any path out is a path data can leave by. Research software still needs some outside services, such as a license server, an activation service or a package mirror.
• A global entry is too wide: a global licensing server opens its server to every VM, all the time. A license that one project pays for would be reachable from every project's VMs.
• Rules follow VM configurations, not VMs: each start of a VM configuration can produce a VM with a new ID and a new IP address. A rule names the configuration, so it follows every VM started from it.
• Explicit rules add a time limit: a server needed once a year for activation stays closed the rest of the time, and opening it is a deliberate act by a user.

When to use a VM access rule

• Some VM configurations need the server in every session: create an Always allowed rule (an implicit rule).
• Some VM configurations need the server for a task, or it should be closed when idle: create a Time-limited access rule (an explicit rule).
• Every VM needs the server: register a global licensing server instead.
• The goal is moving data into tiCrypt: use the Vault, an inbox or an SFTP connection rather than a network path.

An outbound connection carries data both ways

Once a VM can reach a server, software in the VM can send data to it as well as receive from it. Treat every rule, especially one toward a server outside your institution, as a data egress decision, and prefer time-limited rules with short maximum times for such servers.

Before you begin

• The tiCrypt backend is version 3.16.0 or later, with nft.enabled = true in the tiCrypt VM service configuration, and the ticrypt-nft service, version 1.1.0 or later, runs on the host that routes VM traffic. The VM Access Rules table appears in Management only when the backend supports VM access rules.
• To create, edit or delete rules, you are a Super-admin. No permission grants this to other roles.
• You know the server's domain name or IPv4 address, its ports and its protocol. IPv6 addresses are not supported.

Who can do what

Action	Who
Create VM access rule, Edit, Delete	Super-admins only.
See rules	Super-admins see every rule. Other users see the rules that name a VM configuration they can see, and each rule lists only those configurations.
Open access, Close access on time-limited rules	Users who can see the VM configuration: its owners and co-owners with View their VM configurations and those shared with them, users with View all VM configurations, and Super-admins.

note

View all VM configurations lets its holder open access for every VM configuration that a time-limited rule names. Grant it with that in mind.

tiCrypt logs only the setup of rules: creating, editing and deleting them. Opening and closing access is not logged.

View the VM Access Rules

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Virtual Machines section.
3. Click VM Access Rules in the left panel.

Result:

The table lists the rules for the VM configurations you can view, sorted by name. With none, it shows "No VM access rules are available for the VM configurations you can view."

The following table describes the columns of the VM Access Rules table.

Column	Content
Name	The name of the rule. Users see it in the Network access card of a VM configuration and in Open access: rule name.
Type	implicit for an Always allowed rule, explicit for a Time-limited access rule.
VM Configurations	The VM configurations whose VMs the rule serves.
Server	The domain name or IPv4 address the VMs can reach.
Ports	The ports and port ranges, such as 443, 27000-27010.
Protocol	tcp or udp.
Maximum Access (minutes)	For a time-limited rule, the longest time a user can open access for.
Created by	The Super-admin who created the rule.
Created	When the rule was created.

Create a VM Access Rule

Location: Management > Virtual Machines > VM Access Rules

1. Click the Create VM access rule button in the top right panel.
2. In the Create VM access rule pop-up, enter a Name.
3. Under VM configurations, select every VM configuration this rule serves.
4. Under Server, enter the domain name or IPv4 address the VMs may reach, such as license.example.com or 10.0.0.5.
5. Under Network access, enter one or more ports or port ranges, such as 1688 or 27000-27010, and select TCP or UDP.
6. Under Access type, select Always allowed or Time-limited access.
7. For Time-limited access, under Maximum access time, enter the longest time in Minutes a user can open access for.
8. Click Create VM access rule.

Result:

tiCrypt shows "Created VM access rule name" and sends the updated allow list to the firewall right away. For an Always allowed rule, the VMs running from the selected configurations can reach the server. A Time-limited access rule stays closed until a user opens access.

A rule has one protocol. A server that needs both TCP and UDP takes two rules. Ports and ranges that overlap or follow each other are combined into one range.

Edit a VM Access Rule

Location: Management > Virtual Machines > VM Access Rules

1. Select one rule.
2. Click the Open full menu button in the top right panel.
3. Select Edit.
4. In the Update VM access rule: name pop-up, change the fields.
5. Click Update VM access rule.

Result:

tiCrypt shows "Updated VM access rule name", and a change to the server, ports or VM configurations takes effect at once.

A rule changed from Time-limited access to Always allowed drops any access users have opened, since it no longer needs any. A rule changed the other way stays closed until a user opens access.

Open or Close Access on a Time-Limited Rule

Time-limited access belongs to the VM configuration, not to the user who opens it: while access is open, the VM running from that configuration can reach the server, whoever is connected to the VM. Users open access from the VM configuration's menu (Open access: rule name) or from the Network access card of its details; this table offers the same actions.

Location: Management > Virtual Machines > VM Access Rules

1. Select one rule of type explicit.
2. Click Open access, or open the full menu and select Close access.
3. In the pop-up, select the VM configuration.
4. To open access, enter the Access time (minutes). The field starts at 60 minutes, or at the rule's maximum if that is lower, and accepts no more than the maximum.
5. Click Open access or Close access.

Result:

tiCrypt shows "Opened access" or "Closed access" and sends the updated allow list to the firewall right away. Opened access ends at the first refresh after its time runs out, so up to 5 minutes later with the default settings.

• Opening again sets a new end time: opening access that is already open replaces its end time with one counted from now.
• Closing is always safe: "Closing access takes effect immediately. It is safe to close access that is already closed."
• Open connections are not cut: closing access or letting it expire refuses new connections; a connection that is already open continues until the program closes it.

Delete a VM Access Rule

Location: Management > Virtual Machines > VM Access Rules

1. Select one rule.
2. Click the Delete button in the top right panel.
3. In the prompt, click Delete VM access rule.

Result:

The rule is deleted. "Any open access for this rule will be removed immediately", and the VMs of its VM configurations can no longer reach the server unless another rule or a global licensing server allows it.

What happens next

The tiCrypt backend computes the whole per-VM allow list from the rules, the address of each VM running from a VM configuration the rules name, and the time-limited access that has not yet run out. It sends the list to the ticrypt-nft service every 5 minutes by default, right away after any change to a rule or to opened access, and about 30 seconds after a user connects to a VM. Each entry lives 10 minutes in the firewall unless the next list renews it, so if the backend stops sending lists, access lapses instead of staying open.

Deleting a VM configuration removes it from every rule and closes any access opened for it. A rule left with no VM configurations stays in the table so a Super-admin can review and delete it.

Errors and resolutions

Symptom	Cause	Resolution
The VM Access Rules table is missing from Management	The backend is older than 3.16.0	Upgrade the backend.
A VM cannot reach the server of an Always allowed rule	nft.enabled is false, the ticrypt-nft service is not running, or the VM was started from a configuration the rule does not list	Check the tiCrypt VM service configuration and the rule's VM Configurations. On the firewall host, nft list set ip ticrypt ti_alist_vm lists what the firewall allows.
A domain name never becomes reachable	The firewall host cannot resolve the name	ticrypt-nft leaves out a name that has never resolved. Fix name resolution on the firewall host, or use the IPv4 address.
Open access is missing for a user	The rule is Always allowed, or the user cannot see the VM configuration	Only time-limited rules can be opened, and only by users who can see the configuration.

Related

• Dynamic Firewall Rules: implicit and explicit rules in depth, with examples and the firewall sets they fill.
• Global Licensing Servers: open a server to every VM.
• VM Configurations: the VM configurations rules name, and the Network access card researchers open access from.
• VM Service (ticrypt-vm): the nft.enabled and nft.alist-vm-refresh settings.