diff --git a/inventory/host_vars/db-fas01.phx2.fedoraproject.org b/inventory/host_vars/db-fas01.phx2.fedoraproject.org
index 14dc0b4dec..e3df19fe75 100644
--- a/inventory/host_vars/db-fas01.phx2.fedoraproject.org
+++ b/inventory/host_vars/db-fas01.phx2.fedoraproject.org
@@ -43,6 +43,13 @@ custom_rules: [
     # sundries ??? but this is noc01?
     '-A INPUT -p tcp -m tcp -s 10.5.126.41   --dport 5432 -j ACCEPT',
     '-A INPUT -p tcp -m tcp -s 10.5.126.241   --dport 5432 -j ACCEPT',
+
+    # Openshift nodes (egress policy will block connection from non-authorized projects)
+    '-A INPUT -p tcp -m tcp -s 10.5.126.248   --dport 5432 -j ACCEPT',
+    '-A INPUT -p tcp -m tcp -s 10.5.126.164   --dport 5432 -j ACCEPT',
+    '-A INPUT -p tcp -m tcp -s 10.5.126.165   --dport 5432 -j ACCEPT',
+    '-A INPUT -p tcp -m tcp -s 10.5.126.166   --dport 5432 -j ACCEPT',
+    '-A INPUT -p tcp -m tcp -s 10.5.126.167   --dport 5432 -j ACCEPT',
 ]
 #
 # Large updates pushes cause lots of db threads doing the tag moves, so up this from default.