From 4176169bf9026d793c617ba64973370ed1bfbee2 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Mon, 28 May 2018 23:25:30 +0200 Subject: [PATCH] pg firewalling --- modules/ferm/manifests/per_host.pp | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/modules/ferm/manifests/per_host.pp b/modules/ferm/manifests/per_host.pp index e2c0ae8f6..083ef0bf1 100644 --- a/modules/ferm/manifests/per_host.pp +++ b/modules/ferm/manifests/per_host.pp @@ -81,6 +81,14 @@ class ferm::per_host { rule => 'proto tcp daddr 193.62.202.30 dport 80 REDIRECT to-ports 6081', } } + # work around sanger filtering our pg for now + sallinen: { + @ferm::rule { 'dsa-nat-snapshot-varnish': + table => 'nat', + chain => 'PREROUTING', + rule => 'proto tcp daddr 193.62.202.26 dport 443 REDIRECT to-ports 5473', + } + } default: {} } case $::hostname { @@ -282,6 +290,26 @@ class ferm::per_host { rule => '&SERVICE_RANGE(tcp, 5433, ( 2001:1af8:4020:b030:deb::187/128 2001:630:206:4000:1a1a:0:c13e:ca1a/128 ))' } } + sallinen: { + @ferm::rule { 'dsa-postgres-backup': + description => 'Allow postgress access', + rule => '&SERVICE_RANGE(tcp, 5473, ( $HOST_PGBACKUPHOST_V4 ))' + } + @ferm::rule { 'dsa-postgres-backup6': + domain => 'ip6', + description => 'Allow postgress access', + rule => '&SERVICE_RANGE(tcp, 5473, ( $HOST_PGBACKUPHOST_V6 ))' + } + @ferm::rule { 'dsa-postgres-replication': + description => 'Allow postgress access', + rule => '&SERVICE_RANGE(tcp, 5473, ( 185.17.185.187/32 ))' + } + @ferm::rule { 'dsa-postgres-replication6': + domain => 'ip6', + description => 'Allow postgress access', + rule => '&SERVICE_RANGE(tcp, 5473, ( 2001:1af8:4020:b030:deb::187/128 ))' + } + } lw07: { @ferm::rule { 'dsa-postgres-snapshot': description => 'Allow postgress access', -- 2.20.1