forked from infra/ansible
Cleanup nft merge. Chg osbuildapi and nft_custom_rules to use nft_table_filter.
Signed-off-by: James Antill <james@and.org>
This commit is contained in:
James Antill
parent
ba4470365e
commit
3821ea36b5
46 changed files with 284 additions and 267 deletions
|
|
@ -10,7 +10,7 @@ ansible_ifcfg_allowlist:
|
|||
# Make connections from signing bridges stateless, they break sigul connections
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
host_group: autosign
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-releng
|
||||
|
|
|
|||
|
|
@ -2,5 +2,5 @@
|
|||
# Make connections from signing bridges stateless, they break sigul connections
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
host_group: autosign
|
||||
|
|
|
|||
|
|
@ -8,8 +8,8 @@
|
|||
#
|
||||
custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
#
|
||||
# This host is externally reachable
|
||||
#
|
||||
|
|
|
|||
|
|
@ -19,8 +19,8 @@ batcave_ipa_client_shell_groups: []
|
|||
#
|
||||
custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
|
||||
#
|
||||
# Set this to get fasjson-client cron to make the aliases file
|
||||
#
|
||||
|
|
|
|||
|
|
@ -4,8 +4,8 @@ ansible_base: /srv/web/infra
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
#
|
||||
# This host is externally reachable
|
||||
#
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ bodhi_message_routing_keys:
|
|||
# Make connections from signing bridges stateless, they break sigul connections
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept']
|
||||
host_group: bodhi2
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-bodhi
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ bodhi_message_routing_keys:
|
|||
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
|
||||
# this is sign-bridge01.rdu3 ip 10.16.169.120
|
||||
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
|
||||
host_group: bodhi2
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-bodhi
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
lvm_size: 20000
|
||||
mem_size: 2048
|
||||
num_cpus: 2
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
lvm_size: 20000
|
||||
mem_size: 2048
|
||||
num_cpus: 2
|
||||
|
|
|
|||
|
|
@ -31,13 +31,13 @@ nbde_client_bindings:
|
|||
libvirt_host: "{{ inventory_hostname }}"
|
||||
|
||||
nft_custom_rules:
|
||||
- add rule ip filter INPUT iifname virbr0 udp dport bootps accept
|
||||
- add rule ip filter INPUT iifname virbr0 udp dport 53 accept
|
||||
- add rule ip filter INPUT iifname virbr0 tcp dport ssh accept
|
||||
- add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept
|
||||
- add rule ip filter FORWARD iifname "virbr0" ct state new counter accept
|
||||
- add rule ip filter FORWARD ct state established,related counter accept
|
||||
- add rule ip filter FORWARD ip protocol icmp counter accept
|
||||
- add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept
|
||||
- add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept
|
||||
- add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept
|
||||
- add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept
|
||||
- add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept
|
||||
- add rule {{nft_table_filter}} FORWARD ct state established,related counter accept
|
||||
- add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept
|
||||
|
||||
zabbix_macros:
|
||||
CPU.UTIL.CRIT: 100
|
||||
|
|
|
|||
|
|
@ -9,10 +9,10 @@ custom_rules:
|
|||
- '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT'
|
||||
- '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT'
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept'
|
||||
freezes: false
|
||||
tcp_ports: [22,
|
||||
# node_exporter/prometheus
|
||||
|
|
|
|||
|
|
@ -9,10 +9,10 @@ custom_rules:
|
|||
- '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT'
|
||||
- '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT'
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept'
|
||||
freezes: false
|
||||
tcp_ports: [22,
|
||||
# node_exporter/prometheus
|
||||
|
|
|
|||
|
|
@ -111,7 +111,7 @@ ipa_host_group_desc: Download servers
|
|||
nagios_Check_Services:
|
||||
swap: false
|
||||
nft_block_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject'
|
||||
primary_auth_source: ipa
|
||||
zabbix_macros:
|
||||
'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
# Define resources for this group of hosts here.
|
||||
custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept']
|
||||
host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG']
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-accounts
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipatuura
|
||||
ipa_host_group_desc: IPA-tuura SCIM application
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org"
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org"
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_host_group: ipsilon
|
||||
ipa_host_group_desc: Ipsilon SSO application
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept']
|
||||
freezes: false
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-kernel
|
||||
|
|
|
|||
|
|
@ -5,8 +5,8 @@ custom_rules: [
|
|||
'-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT']
|
||||
# Needed for keepalived
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule ip filter INPUT ip protocol vrrp counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept'
|
||||
docker_registry: "candidate-registry.fedoraproject.org"
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-releng
|
||||
|
|
|
|||
|
|
@ -6,8 +6,8 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
# Need for rsync from log01 for logs.
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
ipa_client_shell_groups:
|
||||
- sysadmin-noc
|
||||
- sysadmin-releng
|
||||
|
|
|
|||
|
|
@ -2,9 +2,9 @@
|
|||
# uses interface definition from host vars
|
||||
custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter FORWARD iifname "br0" counter accept'
|
||||
- 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
|
||||
- 'add rule ip filter INPUT iifname "br0" counter accept'
|
||||
- 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept'
|
||||
- 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept'
|
||||
# for iptables rules...maybe other stuff in future? both staging
|
||||
# and prod workers are in this group
|
||||
host_group: openqa-tap-workers
|
||||
|
|
|
|||
|
|
@ -6,10 +6,10 @@ custom_rules: [
|
|||
'-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
# Needed for keepalived
|
||||
- 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule ip filter INPUT ip protocol vrrp counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept'
|
||||
# machinectl api
|
||||
- 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept'
|
||||
datacenter: cloud
|
||||
host_group: cloud
|
||||
lvm_size: 20000
|
||||
|
|
|
|||
|
|
@ -8,35 +8,35 @@ custom_rules: [
|
|||
'-A INPUT -s 47.76.99.127/32 -j REJECT'
|
||||
]
|
||||
nft_block_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject'
|
||||
# For the MOTD
|
||||
db_backup_dir: ['/backups']
|
||||
dbs_to_backup: ['pagure']
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ clamscan_paths:
|
|||
# For the MOTD
|
||||
# Neeed for rsync from log01 for logs.
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept']
|
||||
git_basepath: /
|
||||
git_daemon_user: nobody
|
||||
git_port: 9418
|
||||
|
|
|
|||
|
|
@ -34,90 +34,90 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT',
|
||||
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject'
|
||||
- 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject'
|
||||
nft_custom_rules:
|
||||
# Need for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept'
|
||||
# allow varnish from localhost
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
# also allow varnish from internal for purge requests
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
|
||||
external: true
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
|
|||
|
|
@ -11,44 +11,44 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT',
|
||||
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT']
|
||||
nft_block_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject'
|
||||
nft_custom_rules:
|
||||
# Need for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# allow varnish from localhost
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
# also allow varnish from internal for purge requests
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
# Need for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept'
|
||||
# allow varnish from localhost
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
|
||||
# also allow varnish from internal for purge requests
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
|
||||
external: true
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
|
|||
|
|
@ -9,16 +9,16 @@ custom_rules: [
|
|||
]
|
||||
nft_custom_rules:
|
||||
# Neeed for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Inter-node traffic
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
# In RDU3
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
|
||||
ipa_host_group: rabbitmq
|
||||
ipa_host_group_desc: RabbitMQ service
|
||||
ipa_shell_groups:
|
||||
|
|
|
|||
|
|
@ -9,16 +9,16 @@ custom_rules: [
|
|||
]
|
||||
nft_custom_rules:
|
||||
# Neeed for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Inter-node traffic
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
# In RDU3
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
|
||||
ipa_host_group: rabbitmq
|
||||
ipa_host_group_desc: RabbitMQ service
|
||||
ipa_shell_groups:
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@ custom_rules:
|
|||
- '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT'
|
||||
- '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT'
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept'
|
||||
env: production
|
||||
freezes: false
|
||||
ipa_client_shell_groups:
|
||||
|
|
|
|||
|
|
@ -10,13 +10,13 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
# Needed for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept'
|
||||
# batcave01 also needs access to announce commits.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
deployment_type: prod
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
|
|||
|
|
@ -10,14 +10,14 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
# Neeed for rsync from log01 for logs.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept'
|
||||
# batcave01 also needs access to announce commits.
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
|
||||
deployment_type: stg
|
||||
ipa_client_shell_groups:
|
||||
- fi-apprentice
|
||||
|
|
|
|||
|
|
@ -4,17 +4,17 @@
|
|||
#
|
||||
nft_custom_rules:
|
||||
# Openshift nodes (egress policy will block connection from non-authorized projects)
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept'
|
||||
# noc01 needs to connect to check the db
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
|
||||
# Ipsilon VMs
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept'
|
||||
# This is a generic list, monitored by collectd
|
||||
databases:
|
||||
- fas2
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
#
|
||||
# TODO: lock it down more
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept'
|
||||
# This is a generic list, monitored by collectd
|
||||
databases:
|
||||
- fas2
|
||||
|
|
|
|||
|
|
@ -3,10 +3,10 @@
|
|||
# Only allow postgresql access from the frontend node.
|
||||
#
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
|
||||
# This is a generic list, monitored by collectd
|
||||
databases:
|
||||
- koji
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# Only allow postgresql access from the frontend node.
|
||||
#
|
||||
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept']
|
||||
# This is a generic list, monitored by collectd
|
||||
databases:
|
||||
- koji
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# This is a generic list, monitored by collectd
|
||||
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.172.21 --dport 5432 -j ACCEPT']
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept'
|
||||
databases:
|
||||
- koji
|
||||
datacenter: rdu3
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# We should narrow this down at some point
|
||||
#
|
||||
nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept']
|
||||
# This is a generic list, monitored by collectd
|
||||
databases:
|
||||
- anitya
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
#
|
||||
# We should narrow this down at some point
|
||||
#
|
||||
nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept']
|
||||
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept']
|
||||
# This is a generic list, monitored by collectd
|
||||
databases:
|
||||
- askfedora
|
||||
|
|
|
|||
|
|
@ -6,13 +6,13 @@ custom_rules: [
|
|||
'-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'
|
||||
]
|
||||
nft_custom_rules:
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept'
|
||||
# needed to allow rsync from log01
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
|
||||
# needed to allow 8080 (firmware-proxy from iDRAC mgmt vlans
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept'
|
||||
- 'add rule ip filter INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept'
|
||||
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept'
|
||||
datacenter: rdu3
|
||||
eth0_ipv4_gw: 10.16.163.254
|
||||
eth0_ipv4_ip: 10.16.163.10
|
||||
|
|
|
|||
13
roles/base/templates/nftables/_nft_accept_staging_friends
Normal file
13
roles/base/templates/nftables/_nft_accept_staging_friends
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# _nft_accept_staging_friends
|
||||
|
||||
{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %}
|
||||
#
|
||||
# In the rdu3 datacenter, both production and staging hosts are in different
|
||||
# vlans, and different subnets. However, just as a precaution, we want prod machines to
|
||||
# reject connections from any staging host just in case there's some globally enabled port.
|
||||
# There are however a few hosts in production we have marked 'staging-friendly'
|
||||
# that we do allow staging to talk to for mostly read-only data they need.
|
||||
#
|
||||
add rule {{_tn}} INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited
|
||||
add rule {{_tn}} INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited
|
||||
{% endif %}
|
||||
|
|
@ -11,6 +11,8 @@
|
|||
|
||||
{% include '_nft_accept_vpn' %}
|
||||
|
||||
{% include '_nft_accept_staging_friends' %}
|
||||
|
||||
{% include '_nft_block_rules' %}
|
||||
|
||||
{% include '_nft_accept_ports' %}
|
||||
|
|
|
|||
|
|
@ -17,6 +17,8 @@ add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept
|
|||
# This rejects all VPN traffic at the end. 192.168.100.0/24
|
||||
{% include '_nft_accept_vpn' %}
|
||||
|
||||
{% include '_nft_accept_staging_friends' %}
|
||||
|
||||
add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept
|
||||
|
||||
{% if datacenter == 'rdu3' %}
|
||||
|
|
|
|||
|
|
@ -31,33 +31,33 @@ add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept
|
|||
add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept
|
||||
{% endif %}
|
||||
|
||||
# tang for buildhw
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept
|
||||
|
||||
# DNS
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept
|
||||
|
||||
# bastion smtp
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept
|
||||
|
||||
# infra.fp.o
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept
|
||||
|
||||
# rsyslog out to log01
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept
|
||||
|
||||
# SSH
|
||||
add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept
|
||||
add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept
|
||||
# add rdu3 ansible control host for now
|
||||
add rule {{_tn}} INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept
|
||||
|
|
@ -66,7 +66,7 @@ add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept
|
|||
|
||||
{% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %}
|
||||
# Allow SSHFS binding to koji01
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept
|
||||
add rule {{_tn}} OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept
|
||||
{% endif %}
|
||||
|
||||
# http to pull sources from pkgs lookaside
|
||||
|
|
|
|||
|
|
@ -14,16 +14,16 @@
|
|||
# 2. Checking if it exists and failing with a "nice" message, if it doesn't.
|
||||
# 3. Waiting for it to exist.
|
||||
|
||||
# if ! nft list set ip filter osbuildapi >& /dev/null; then
|
||||
# if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then
|
||||
# exit 0
|
||||
# fi
|
||||
|
||||
if ! nft list set ip filter osbuildapi >& /dev/null; then
|
||||
echo "OSBUILD: nft set ip filter osbuildapi: Doesn't exist" 1>&2;
|
||||
if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then
|
||||
echo "OSBUILD: nft set {{nft_table_filter}} osbuildapi: Doesn't exist" 1>&2;
|
||||
exit 2
|
||||
fi
|
||||
|
||||
while ! nft list set ip filter osbuildapi >& /dev/null; do
|
||||
while ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; do
|
||||
sleep 10
|
||||
done
|
||||
|
||||
|
|
@ -47,15 +47,15 @@ NEWIDENTITYIPS=`echo "$RESOLVEQUERY" | grep link | sed -E 's/.* ([0-9]+\.[0-9]+\
|
|||
# Empty the filter: We do this at the end for a small window.`
|
||||
# NOTE: We aren't flushing old entries anymore.
|
||||
# See commit: e7b50aaee469fdded0ea650c7e7f4dd06e929609
|
||||
# nft flush set ip filter osbuildapi
|
||||
# nft flush set {{nft_table_filter}} osbuildapi
|
||||
|
||||
# Add the IPs...
|
||||
for j in $NEWIPS
|
||||
do
|
||||
nft add element ip filter osbuildapi { $j }
|
||||
nft add element {{nft_table_filter}} osbuildapi { $j }
|
||||
done
|
||||
|
||||
for j in $NEWIDENTITYIPS
|
||||
do
|
||||
nft add element ip filter osbuildapi { $j }
|
||||
nft add element {{nft_table_filter}} osbuildapi { $j }
|
||||
done
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue