dkirwan/infra-ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Nagios: remove nrpe from the firewall config

Browse source 
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
This commit is contained in:
Greg Sutcliffe 2026-07-01 13:25:44 +01:00
commit fbf73ff1f9
Signed by: gwmngilfen
SSH key fingerprint: SHA256:dNHcz65ApR68w2TkCIAXDBdt4oNL62Fyx48U7dXWuk0
9 changed files with 0 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

3
roles/base/templates/iptables/ip6tables
View file

@ -29,9 +29,6 @@
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe (if we want noc02 to be able to get into remote systems)
#-A INPUT -p tcp -m tcp --dport 5666 -s 2600:2701:4000:5211:dead:beef:00fe:fed9 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}

3
roles/base/templates/iptables/iptables
View file

@ -17,9 +17,6 @@
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.15 -j ACCEPT

3
roles/base/templates/iptables/iptables.bastion
View file

@ -17,9 +17,6 @@
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.15 -j ACCEPT

3
roles/base/templates/iptables/iptables.osuosl
View file

@ -27,9 +27,6 @@
# external ip for rdu3
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 38.145.32.0/24 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.15 -j ACCEPT

3
roles/base/templates/iptables/iptables.releng
View file

@ -18,9 +18,6 @@
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Overwrite any global rules
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp -s 192.168.1.10 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.1.166 --dport 5666 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp -s 38.145.32.16 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 38.145.32.15 --dport 5666 -j ACCEPT

3
roles/base/templates/iptables/iptables.staging
View file

@ -17,9 +17,6 @@
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.15 -j ACCEPT

3
roles/base/templates/iptables/iptables.storinator01.fedorainfracloud.org
View file

@ -24,9 +24,6 @@
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.15 -j ACCEPT

3
roles/base/templates/iptables/iptables.torrent02.fedoraproject.org
View file

@ -24,9 +24,6 @@
# allow ssh - always
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.16 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 38.145.32.15 -j ACCEPT

12
roles/base/templates/nftables/_nft_accept_monitoring
View file

@ -1,18 +1,6 @@
# _nft_accept_monitoring
# Default accept policy, let things be monitored
# for Nagios/nrpe - allow it from nocs
# NOTE: These were still here in staging, before the cleanup.
#add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
#add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
#add rule {{_tn}} INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule {{_tn}} INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule {{_tn}} INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
# NOTE: This was in staging only, before the cleanup. But seems dead.
#add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# Greg has configured zabbix so the host calls out to the server, so we
# shouldn't need to accept anything on 10050/10051.
# Leaving them here commented out for a bit. 2026-06-03