WarlockFish/fedora-infra_ansible
1
0
Fork 0
mirror of https://pagure.io/fedora-infra/ansible.git synced 2026-04-29 13:01:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

nftables: some more tweaks, add batcave01.iad2 to be able to manage rdu3 builders, adjust osuosl for new external ips

Browse Source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi
2025-06-24 10:35:37 -07:00
parent 545dfcf84e
commit 0efed466be
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
roles/base/templates/nftables/nftables.kojibuilder
View File

@@ -109,6 +109,9 @@ add rule ip filter OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept
# SSH
add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept
add rule ip filter OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept
# add iad2 ansible control host for now
add rule ip filter INPUT ip saddr 10.3.163.35/32 tcp dport 22 counter accept
add rule ip filter OUTPUT ip daddr 10.3.163.35/19 tcp sport 22 counter accept
{% endif %}
# End of RDU3

6
roles/base/templates/nftables/nftables.osuosl
View File

@@ -26,14 +26,18 @@ add rule ip filter INPUT ip saddr {{ ip }} counter drop
add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept
# external ip for iad2
add rule ip filter INPUT ip saddr 38.145.60.0/24 ct state new tcp dport 22 counter accept
# external ip for rdu3
add rule ip filter INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}