Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

iptables: adjust for new noc01 ip, drop some iptables files no longer used.

Browse source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2020-06-30 14:24:09 -07:00
parent b7a5fbcc7e
commit f8c4957c95
8 changed files with 12 additions and 188 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/base/templates/iptables/iptables
View file

@ -28,8 +28,8 @@
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.15 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.3.163.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.3.166.10 -j ACCEPT

4
roles/base/templates/iptables/iptables.osuosl
View file

@ -31,8 +31,8 @@
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.15 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT

88
roles/base/templates/iptables/iptables.pgbdr01.stg.phx2.fedoraproject.org
View file

@ -1,88 +0,0 @@
# {{ ansible_managed }}
*nat
:PREROUTING ACCEPT []
:POSTROUTING ACCEPT []
:OUTPUT ACCEPT []
# Redirect staging attempts to talk to the external proxy to an internal ip.
# This is primarily for openid in staging which needs to get around proxy
# redirects.
-A OUTPUT -d 209.132.181.5 -j DNAT --to-destination 10.5.128.177
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# allow ping and traceroute
-A INPUT -p icmp -j ACCEPT
# localhost is fine
-A INPUT -i lo -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
-A INPUT -s {{ ip }} -j DROP
{% endfor %}
{% endif %}
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.128.38 -j ACCEPT
# if the host declares a fedmsg-enabled wsgi app, open ports for it
{% if wsgi_fedmsg_service is defined %}
{% for i in range(wsgi_procs * wsgi_threads) %}
-A INPUT -p tcp -m tcp --dport 30{{ '%02d' % i }} -j ACCEPT
{% endfor %}
{% endif %}
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
# This is a replicating postgresql server, allow db connections from clients
{% for host in groups['postgres_clients']|sort %}
{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
-A INPUT -s {{ hostvars[host]['eth0_ip'] }} -p tcp -m tcp --dport 5432 -j ACCEPT
{% else %}# {{ host }} has no 'eth0_ip' listed
{% endif %}
{% endfor %}
{% for host in groups['postgres_clients_stg']|sort %}
{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
-A INPUT -s {{ hostvars[host]['eth0_ip'] }} -p tcp -m tcp --dport 5432 -j ACCEPT
{% else %}# {{ host }} has no 'eth0_ip' listed
{% endif %}
{% endfor %}
# otherwise kick everything out
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

88
roles/base/templates/iptables/iptables.pgbdr02.stg.phx2.fedoraproject.org
View file

@ -1,88 +0,0 @@
# {{ ansible_managed }}
*nat
:PREROUTING ACCEPT []
:POSTROUTING ACCEPT []
:OUTPUT ACCEPT []
# Redirect staging attempts to talk to the external proxy to an internal ip.
# This is primarily for openid in staging which needs to get around proxy
# redirects.
-A OUTPUT -d 209.132.181.5 -j DNAT --to-destination 10.5.128.177
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# allow ping and traceroute
-A INPUT -p icmp -j ACCEPT
# localhost is fine
-A INPUT -i lo -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
-A INPUT -s {{ ip }} -j DROP
{% endfor %}
{% endif %}
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.128.38 -j ACCEPT
# if the host declares a fedmsg-enabled wsgi app, open ports for it
{% if wsgi_fedmsg_service is defined %}
{% for i in range(wsgi_procs * wsgi_threads) %}
-A INPUT -p tcp -m tcp --dport 30{{ '%02d' % i }} -j ACCEPT
{% endfor %}
{% endif %}
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
# This is a replicating postgresql server, allow db connections from clients
{% for host in groups['postgres_clients']|sort %}
{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
-A INPUT -s {{ hostvars[host]['eth0_ip'] }} -p tcp -m tcp --dport 5432 -j ACCEPT
{% else %}# {{ host }} has no 'eth0_ip' listed
{% endif %}
{% endfor %}
{% for host in groups['postgres_clients_stg']|sort %}
{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
-A INPUT -s {{ hostvars[host]['eth0_ip'] }} -p tcp -m tcp --dport 5432 -j ACCEPT
{% else %}# {{ host }} has no 'eth0_ip' listed
{% endif %}
{% endfor %}
# otherwise kick everything out
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

4
roles/base/templates/iptables/iptables.releng
View file

@ -22,8 +22,8 @@
-A INPUT -p tcp -m tcp -s 192.168.1.10 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.1.166 --dport 5666 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp -s 209.132.181.102 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 209.132.181.35 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 38.145.60.16 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 38.145.60.15 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 10.3.163.10 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 10.3.166.10 --dport 5666 -j ACCEPT

4
roles/base/templates/iptables/iptables.staging
View file

@ -42,8 +42,8 @@ COMMIT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.15 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.128.38 -j ACCEPT

4
roles/base/templates/iptables/iptables.storinator01.fedorainfracloud.org
View file

@ -28,8 +28,8 @@
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.15 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports_eth0 is defined %}

4
roles/base/templates/iptables/iptables.torrent02.fedoraproject.org
View file

@ -28,8 +28,8 @@
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.60.15 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT