iad2: drop phx2 koji builder iptables, fix iad2 iptables to not have a syntax error
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi
parent
0082dc0996
commit
1f467abfce
1 changed files with 0 additions and 190 deletions
|
|
@ -1,4 +1,3 @@
|
|||
{% if datacenter == 'phx2' %}
|
||||
# {{ ansible_managed }}
|
||||
*filter
|
||||
:INPUT DROP []
|
||||
|
|
@ -29,203 +28,15 @@
|
|||
{% endif %}
|
||||
|
||||
# kojipkgs
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.36 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.35 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.36 --dport 443 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.169.106 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.169.107 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
#koji.fp.o
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 443 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.169.104 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.169.105 --dport 443 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
#arm.koji.fp.o
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.124.138 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.124.138 --dport 443 -j ACCEPT
|
||||
|
||||
#ppc.koji.fp.o
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.129.240 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.129.240 --dport 443 -j ACCEPT
|
||||
|
||||
#s390.koji.fp.o
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.129.180 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.129.180 --dport 443 -j ACCEPT
|
||||
|
||||
# compose-x86-01.fp.o
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.41 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.41 --dport 443 -j ACCEPT
|
||||
|
||||
# DNS
|
||||
-A OUTPUT -p udp -m udp -d 10.5.126.21 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p udp -m udp -d 10.5.126.22 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.21 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.22 --dport 53 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p udp -m udp -d 10.3.163.33 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.33 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p udp -m udp -d 10.3.163.34 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.34 --dport 53 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
# bastion smtp
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.12 --dport 25 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.31 --dport 25 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
# infra.fp.o
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.23 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.23 --dport 443 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.35 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.35 --dport 443 -j ACCEPT
|
||||
{% endif %}
|
||||
-A OUTPUT -p tcp -m tcp -d 38.145.60.16 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 38.145.60.16 --dport 443 -j ACCEPT
|
||||
|
||||
|
||||
# rsyslog out to log01
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.13 --dport 514 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.39 --dport 514 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
# SSH
|
||||
-A INPUT -p tcp -m tcp -s 10.5.0.0/16 --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.0.0/16 --sport 22 -j ACCEPT
|
||||
-A INPUT -p tcp -m tcp -s 10.3.160.0/19 --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.160.0/19 --sport 22 -j ACCEPT
|
||||
|
||||
{% if inventory_hostname.startswith (('buildvm-s390x-15', 'buildvm-s390x-16','buildvm-s390x-17')) %}
|
||||
# Allow SSHFS binding to koji01
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.125.61 --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.169.104 --dport 22 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
# git to pkgs
|
||||
-A OUTPUT -m tcp -p tcp --dport 9418 -d 10.5.125.44 -j ACCEPT
|
||||
-A OUTPUT -m udp -p udp --dport 9418 -d 10.5.125.44 -j ACCEPT
|
||||
|
||||
# http to pull sources from pkgs lookaside
|
||||
-A OUTPUT -m tcp -p tcp --dport 80 -d 10.5.125.44 -j ACCEPT
|
||||
|
||||
# git on pagure,io
|
||||
-A OUTPUT -p tcp -m tcp -d 8.43.85.75 --dport 443 -j ACCEPT
|
||||
|
||||
# admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10)
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.8 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.8 --dport 443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.9 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.9 --dport 443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.51 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.51 --dport 443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.52 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.52 --dport 443 -j ACCEPT
|
||||
# for 2 facter auth
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.30 --dport 8443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.25 --dport 8443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.5.126.26 --dport 8443 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.74 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.74 --dport 443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.75 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.75 --dport 443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.76 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.76 --dport 443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.77 --dport 80 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.77 --dport 443 -j ACCEPT
|
||||
# for 2 facter auth
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.74 --dport 8443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.75 --dport 8443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.76 --dport 8443 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.77 --dport 8443 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
#nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but
|
||||
# kinda necessary
|
||||
-A INPUT -m tcp -p tcp -s 10.5.88.36 -j ACCEPT
|
||||
-A OUTPUT -m tcp -p tcp -d 10.5.88.36 -j ACCEPT
|
||||
-A INPUT -m udp -p udp -s 10.5.88.36 -j ACCEPT
|
||||
-A OUTPUT -m udp -p udp -d 10.5.88.36 -j ACCEPT
|
||||
# also new c-mode filer (remove above after switch)
|
||||
-A INPUT -m tcp -p tcp -s 10.5.88.41 -j ACCEPT
|
||||
-A OUTPUT -m tcp -p tcp -d 10.5.88.41 -j ACCEPT
|
||||
-A INPUT -m udp -p udp -s 10.5.88.41 -j ACCEPT
|
||||
-A OUTPUT -m udp -p udp -d 10.5.88.41 -j ACCEPT
|
||||
|
||||
# ntp
|
||||
-A OUTPUT -m udp -p udp --dport 123 -d 10.5.126.11 -j ACCEPT
|
||||
-A OUTPUT -m udp -p udp --dport 123 -d 10.5.126.12 -j ACCEPT
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -m udp -p udp --dport 123 -d 10.3.163.31 -j ACCEPT
|
||||
-A OUTPUT -m udp -p udp --dport 123 -d 10.3.163.32 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
# dhcp
|
||||
-A OUTPUT -m udp -p udp --dport 67 -d 10.5.126.41 -j ACCEPT
|
||||
|
||||
# if the host/group defines incoming tcp_ports - allow them
|
||||
{% for port in tcp_ports %}
|
||||
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
# if the host/group defines incoming udp_ports - allow them
|
||||
{% for port in udp_ports %}
|
||||
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
# if there are custom rules - put them in as-is
|
||||
{% for rule in custom_rules %}
|
||||
{{ rule }}
|
||||
{% endfor %}
|
||||
COMMIT
|
||||
{% elif datacenter == 'iad2' %}
|
||||
# {{ ansible_managed }}
|
||||
*filter
|
||||
:INPUT DROP []
|
||||
:FORWARD DROP []
|
||||
:OUTPUT DROP []
|
||||
|
||||
# loopback allowed
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
-A OUTPUT -o lo -j ACCEPT
|
||||
-A INPUT -i virbr0 -j ACCEPT
|
||||
-A OUTPUT -o virbr0 -j ACCEPT
|
||||
-A INPUT -d 127.0.0.0/8 -j ACCEPT
|
||||
-A OUTPUT -d 127.0.0.0/8 -j ACCEPT
|
||||
|
||||
# Accept ping and traceroute (needs icmp)
|
||||
-A INPUT -p icmp -j ACCEPT
|
||||
-A OUTPUT -p icmp -j ACCEPT
|
||||
|
||||
# Established connections allowed
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# if the blocked_ips is defined - drop them
|
||||
{% if blocked_ips is defined %}
|
||||
{% for ip in blocked_ips %}
|
||||
-A INPUT -s {{ ip }} -j DROP
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# kojipkgs
|
||||
{% if host in groups['buildvm_s390x'] %}
|
||||
-A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
# DNS
|
||||
-A OUTPUT -p udp -m udp -d 10.3.163.33 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p udp -m tcp -d 10.3.163.33 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m udp -d 10.3.163.34 --dport 53 -j ACCEPT
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.34 --dport 53 -j ACCEPT
|
||||
|
||||
# bastion smtp
|
||||
-A OUTPUT -p tcp -m tcp -d 10.3.163.31 --dport 25 -j ACCEPT
|
||||
|
|
@ -306,4 +117,3 @@ COMMIT
|
|||
{{ rule }}
|
||||
{% endfor %}
|
||||
COMMIT
|
||||
{% endif %}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue