mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-05-02 06:20:26 +08:00
195 lines
7.9 KiB
Plaintext
195 lines
7.9 KiB
Plaintext
# {{ ansible_managed }}
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT DROP [0:0]
|
|
|
|
# loopback allowed
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A OUTPUT -o lo -j ACCEPT
|
|
-A INPUT -i virbr0 -j ACCEPT
|
|
-A OUTPUT -o virbr0 -j ACCEPT
|
|
-A INPUT -d 127.0.0.0/8 -j ACCEPT
|
|
-A OUTPUT -d 127.0.0.0/8 -j ACCEPT
|
|
|
|
# Accept ping and traceroute (needs icmp)
|
|
-A INPUT -p icmp -j ACCEPT
|
|
-A OUTPUT -p icmp -j ACCEPT
|
|
|
|
# Established connections allowed
|
|
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
# if the blocked_ips is defined - drop them
|
|
{% if blocked_ips is defined %}
|
|
{% for ip in blocked_ips %}
|
|
-A INPUT -s {{ ip }} -j DROP
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if host in groups['osbuild'] %}
|
|
# osbuild api for osbuild koji plugin
|
|
-A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT
|
|
{% endif %}
|
|
|
|
# kojipkgs
|
|
{% if host in groups['buildvm_s390x'] %}
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.0.17 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.0.35 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.1.102.24 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.1.102.50 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.169.106 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.169.107 --dport 80 -j ACCEPT
|
|
{% endif %}
|
|
|
|
# tang for buildhw
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.37 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.38 --dport 80 -j ACCEPT
|
|
|
|
# DNS
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.33 --dport 53 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.33 --dport 53 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.34 --dport 53 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.34 --dport 53 -j ACCEPT
|
|
|
|
# bastion smtp
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.31 --dport 25 -j ACCEPT
|
|
|
|
# infra.fp.o
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.35 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.35 --dport 443 -j ACCEPT
|
|
|
|
# rsyslog out to log01
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.39 --dport 514 -j ACCEPT
|
|
|
|
# SSH
|
|
-A INPUT -p tcp -m tcp -s 10.16.160.0/19 --dport 22 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.160.0/19 --sport 22 -j ACCEPT
|
|
{% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %}
|
|
# Allow SSHFS binding to koji01
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.169.104 --dport 22 -j ACCEPT
|
|
{% endif %}
|
|
|
|
# http to pull sources from pkgs lookaside
|
|
#-A OUTPUT -m tcp -p tcp --dport 80 -d 10.5.125.44 -j ACCEPT
|
|
|
|
# https git on pagure,io
|
|
-A OUTPUT -p tcp -m tcp -d 8.43.85.76 --dport 443 -j ACCEPT
|
|
|
|
# admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10)
|
|
{% if host in groups['staging'] %}
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.74 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.74 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.75 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.75 --dport 443 -j ACCEPT
|
|
{% endif %}
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.74 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.74 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.75 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.75 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.76 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.76 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.77 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.77 --dport 443 -j ACCEPT
|
|
|
|
# ipa client ports
|
|
{% if host in groups['staging'] %}
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.21 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.63 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.21 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.63 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.21 --dport 389 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.63 --dport 389 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.21 --dport 636 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.63 --dport 636 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.21 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.63 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.166.21 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.166.63 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.21 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.166.63 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.166.21 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.166.63 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.166.21 --dport 53 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.166.63 --dport 53 -j ACCEPT
|
|
{% else %}
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.54 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.55 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.104 --dport 80 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.54 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.55 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.104 --dport 443 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.54 --dport 389 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.55 --dport 389 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.104 --dport 389 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.54 --dport 636 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.55 --dport 636 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.104 --dport 636 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.54 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.55 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.104 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.54 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.55 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.104 --dport 88 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.54 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.55 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.163.104 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.54 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.55 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.104 --dport 464 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.54 --dport 53 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.55 --dport 53 -j ACCEPT
|
|
-A OUTPUT -p udp -m udp -d 10.16.163.104 --dport 53 -j ACCEPT
|
|
{% endif %}
|
|
|
|
{% if host in groups['staging'] %}
|
|
# Allow nfs from koji01
|
|
-A INPUT -p tcp -m tcp -d 10.16.167.64 --dport 2049 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.167.64 --dport 2049 -j ACCEPT
|
|
{% endif %}
|
|
#nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but
|
|
# kinda necessary
|
|
-A INPUT -m tcp -p tcp -s 10.16.162.11 -j ACCEPT
|
|
-A OUTPUT -m tcp -p tcp -d 10.16.162.11 -j ACCEPT
|
|
-A INPUT -m udp -p udp -s 10.16.162.11 -j ACCEPT
|
|
-A OUTPUT -m udp -p udp -d 10.16.162.11 -j ACCEPT
|
|
-A INPUT -m tcp -p tcp -s 10.16.162.12 -j ACCEPT
|
|
-A OUTPUT -m tcp -p tcp -d 10.16.162.12 -j ACCEPT
|
|
-A INPUT -m udp -p udp -s 10.16.162.12 -j ACCEPT
|
|
-A OUTPUT -m udp -p udp -d 10.16.162.12 -j ACCEPT
|
|
-A INPUT -m tcp -p tcp -s 10.16.162.13 -j ACCEPT
|
|
-A OUTPUT -m tcp -p tcp -d 10.16.162.13 -j ACCEPT
|
|
-A INPUT -m udp -p udp -s 10.16.162.13 -j ACCEPT
|
|
-A OUTPUT -m udp -p udp -d 10.16.162.13 -j ACCEPT
|
|
-A INPUT -m tcp -p tcp -s 10.16.162.14 -j ACCEPT
|
|
-A OUTPUT -m tcp -p tcp -d 10.16.162.14 -j ACCEPT
|
|
-A INPUT -m udp -p udp -s 10.16.162.14 -j ACCEPT
|
|
-A OUTPUT -m udp -p udp -d 10.16.162.14 -j ACCEPT
|
|
|
|
# ntp
|
|
-A OUTPUT -m udp -p udp --dport 123 -d 10.16.163.31 -j ACCEPT
|
|
-A OUTPUT -m udp -p udp --dport 123 -d 10.16.163.32 -j ACCEPT
|
|
|
|
# dhcp
|
|
-A OUTPUT -m udp -p udp --dport 67 -d 10.16.163.10 -j ACCEPT
|
|
|
|
# s390x builders ssh
|
|
-A INPUT -p tcp -m tcp -s 10.16.0.0/16 --dport 22 -j ACCEPT
|
|
-A OUTPUT -p tcp -m tcp -d 10.16.0.0/16 --sport 22 -j ACCEPT
|
|
|
|
# if the host/group defines incoming tcp_ports - allow them
|
|
{% for port in tcp_ports %}
|
|
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
|
|
{% endfor %}
|
|
|
|
# if the host/group defines incoming udp_ports - allow them
|
|
{% for port in udp_ports %}
|
|
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
|
|
{% endfor %}
|
|
|
|
# if there are custom rules - put them in as-is
|
|
{% for rule in custom_rules %}
|
|
{{ rule }}
|
|
{% endfor %}
|
|
COMMIT
|