diff --git a/inventory/host_vars/osuosl03.fedoraproject.org b/inventory/host_vars/osuosl03.fedoraproject.org
new file mode 100644
index 0000000000..e264442e48
--- /dev/null
+++ b/inventory/host_vars/osuosl03.fedoraproject.org
@@ -0,0 +1,3 @@
+---
+datacenter: osuosl
+virthost: true
diff --git a/inventory/inventory b/inventory/inventory
index 9c1f0bc8c8..e038eedb35 100644
--- a/inventory/inventory
+++ b/inventory/inventory
@@ -123,6 +123,7 @@ ibiblio04.fedoraproject.org
 internetx01.fedoraproject.org
 osuosl01.fedoraproject.org
 osuosl02.fedoraproject.org
+osuosl03.fedoraproject.org
 serverbeach06.fedoraproject.org
 serverbeach07.fedoraproject.org
 serverbeach08.fedoraproject.org
diff --git a/playbooks/groups/virthost.yml b/playbooks/groups/virthost.yml
index bb7b71c3da..42da5c9cda 100644
--- a/playbooks/groups/virthost.yml
+++ b/playbooks/groups/virthost.yml
@@ -3,7 +3,7 @@
 # NOTE: most of these vars_path come from group_vars/backup_server or from hostvars
 
 - name: make virthost server system
-  hosts: virthost15.phx2.fedoraproject.org:bvirthost07.phx2.fedoraproject.org:buildvmhost-10.phx2.fedoraproject.org:buildvmhost-11.phx2.fedoraproject.org:buildvmhost-12.phx2.fedoraproject.org:virthost01.phx2.fedoraproject.org:virthost03.phx2.fedoraproject.org:ibiblio04.fedoraproject.org:bvirthost06.phx2.fedoraproject.org:bvirthost08.phx2.fedoraproject.org:bvirthost09.phx2.fedoraproject.org:bvirthost10.phx2.fedoraproject.org:bvirthost11.phx2.fedoraproject.org:virthost16.phx2.fedoraproject.org:virthost17.phx2.fedoraproject.org:virthost18.phx2.fedoraproject.org:serverbeach07.fedoraproject.org:qa07.qa.fedoraproject.org:coloamer01.fedoraproject.org:qa04.qa.fedoraproject.org:qa05.qa.fedoraproject.org
+  hosts: virthost15.phx2.fedoraproject.org:bvirthost07.phx2.fedoraproject.org:buildvmhost-10.phx2.fedoraproject.org:buildvmhost-11.phx2.fedoraproject.org:buildvmhost-12.phx2.fedoraproject.org:virthost01.phx2.fedoraproject.org:virthost03.phx2.fedoraproject.org:ibiblio04.fedoraproject.org:bvirthost06.phx2.fedoraproject.org:bvirthost08.phx2.fedoraproject.org:bvirthost09.phx2.fedoraproject.org:bvirthost10.phx2.fedoraproject.org:bvirthost11.phx2.fedoraproject.org:virthost16.phx2.fedoraproject.org:virthost17.phx2.fedoraproject.org:virthost18.phx2.fedoraproject.org:serverbeach07.fedoraproject.org:qa07.qa.fedoraproject.org:coloamer01.fedoraproject.org:qa04.qa.fedoraproject.org:qa05.qa.fedoraproject.org:osuosl03.fedoraproject.org
   user: root
   accelerate: "{{ accelerated }}"
   gather_facts: True
diff --git a/roles/base/templates/iptables/iptables.osuosl b/roles/base/templates/iptables/iptables.osuosl
new file mode 100644
index 0000000000..d2701a91a5
--- /dev/null
+++ b/roles/base/templates/iptables/iptables.osuosl
@@ -0,0 +1,68 @@
+# {{ ansible_managed }}
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+
+# allow ping and traceroute
+-A INPUT -p icmp -j ACCEPT
+
+# localhost is fine
+-A INPUT -i lo -j ACCEPT
+
+# Established connections allowed
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# allow ssh only from needed ips
+# vpn in from tun0
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 192.168.0.0/24 -i tun0 -j ACCEPT
+# external ip for phx2
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 209.132.181.0/24 -j ACCEPT
+# external ip for scrye
+-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 75.148.32.185 -j ACCEPT
+
+# for fireball mode - allow port 5099 from lockbox and it's ips
+-A INPUT -p tcp -m tcp --dport 5099 -s 192.168.1.58 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.126.23 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.127.51 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5099 -s 209.132.181.6 -j ACCEPT
+
+# for nrpe - allow it from nocs
+-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
+# FIXME - this is the global nat-ip and we need the noc01-specific ip
+-A INPUT -p tcp -m tcp --dport 5666  -s 209.132.181.102 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5666  -s 209.132.181.35 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
+
+
+# if the host/group defines incoming tcp_ports - allow them
+{% if tcp_ports is defined %}
+{% for port in tcp_ports %}
+-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
+{% endfor %}
+{% endif %}
+
+# if the host/group defines incoming udp_ports - allow them
+{% if udp_ports is defined %}
+{% for port in udp_ports %}
+-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
+{% endfor %}
+{% endif %}
+
+# if there are custom rules - put them in as-is
+{% if custom_rules is defined %}
+{% for rule in custom_rules %}
+{{ rule }}
+{% endfor %}
+{% endif %}
+
+# otherwise kick everything out
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+{% if virthost is defined %}
+-A FORWARD -s 67.203.2.64/29 -j ACCEPT
+-A FORWARD -d 67.203.2.64/29 -j ACCEPT
+{% else %}
+-A FORWARD -j REJECT --reject-with icmp-host-prohibited
+{% endif %}
+COMMIT