blob: 2b81658967b2338c9b51642ee3d23f538bc096e2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
# {{ ansible_managed }}
*filter
:INPUT DROP []
:FORWARD DROP []
:OUTPUT DROP []
# loopback allowed
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i virbr0 -j ACCEPT
-A OUTPUT -o virbr0 -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j ACCEPT
-A OUTPUT -d 127.0.0.0/8 -j ACCEPT
# Accept ping and traceroute (needs icmp)
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# kojipkgs
-A OUTPUT -p tcp -m tcp -d 10.5.125.36 --dport 80 -j ACCEPT
#koji.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.125.63 --dport 443 -j ACCEPT
#arm.koji.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.124.138 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.124.138 --dport 443 -j ACCEPT
# compose-x86-02.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.125.42 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.125.42 --dport 443 -j ACCEPT
# compose-x86-01.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.125.41 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.125.41 --dport 443 -j ACCEPT
# DNS
-A OUTPUT -p udp -m udp -d 10.5.126.21 --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp -d 10.5.126.22 --dport 53 -j ACCEPT
# bastion smtp
-A OUTPUT -p tcp -m tcp -d 10.5.126.12 --dport 25 -j ACCEPT
# infra.fp.o
-A OUTPUT -p tcp -m tcp -d 10.5.126.23 --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.126.23 --dport 443 -j ACCEPT
# rsyslog out to log01
-A OUTPUT -p tcp -m tcp -d 10.5.126.13 --dport 514 -j ACCEPT
# SSH
-A INPUT -p tcp -m tcp -s 10.5.0.0/16 --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d 10.5.0.0/16 --sport 22 -j ACCEPT
# git to pkgs
-A OUTPUT -m tcp -p tcp --dport 9418 -d 10.5.125.44 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 9418 -d 10.5.125.44 -j ACCEPT
# http to pull sources from pkgs lookaside
-A OUTPUT -m tcp -p tcp --dport 80 -d 10.5.125.44 -j ACCEPT
# git to fedorahosted
-A OUTPUT -m tcp -p tcp --dport 9418 -d 66.135.62.191 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 9418 -d 66.135.62.191 -j ACCEPT
# admin.fedoraproject.org for fas
-A OUTPUT -p tcp -m tcp -d admin.fedoraproject.org --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp -d admin.fedoraproject.org --dport 443 -j ACCEPT
# for 2 facter auth
-A OUTPUT -p tcp -m tcp -d fas-all.phx2.fedoraproject.org --dport 8443 -j ACCEPT
#nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but
# kinda necessary
-A INPUT -m tcp -p tcp -s 10.5.88.36 -j ACCEPT
-A OUTPUT -m tcp -p tcp -d 10.5.88.36 -j ACCEPT
-A INPUT -m udp -p udp -s 10.5.88.36 -j ACCEPT
-A OUTPUT -m udp -p udp -d 10.5.88.36 -j ACCEPT
# ntp
-A OUTPUT -m udp -p udp --dport 123 -d 66.187.233.4 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 192.43.244.18 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 128.118.25.5 -j ACCEPT
-A OUTPUT -m udp -p udp --dport 123 -d 204.152.184.72 -j ACCEPT
# dhcp
-A OUTPUT -m udp -p udp --dport 67 -d 10.5.126.41 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
COMMIT
|
