From d2adc3a6d3ab6a42cc0a1c99c2ff8681667409e0 Mon Sep 17 00:00:00 2001 From: Rodrigo Arias Mallo Date: Wed, 24 Apr 2024 16:55:06 +0200 Subject: [PATCH] Add firewall rules for Ceph and monitoring The firewall was blocking the monitoring traffic from hut and the Ceph traffic among OSDs. The rules only allow connecting from the specific host that they are supposed to be coming from. Reviewed-by: Aleix Roca Nonell --- m/bay/configuration.nix | 10 ++++++++++ m/lake2/configuration.nix | 8 ++++++++ 2 files changed, 18 insertions(+) diff --git a/m/bay/configuration.nix b/m/bay/configuration.nix index 70b7165..ac34f69 100644 --- a/m/bay/configuration.nix +++ b/m/bay/configuration.nix @@ -23,6 +23,16 @@ address = "10.0.42.40"; prefixLength = 24; } ]; + firewall = { + extraCommands = '' + # Accept all incoming TCP traffic from lake2 + iptables -A nixos-fw -p tcp -s lake2 -j nixos-fw-accept + # Accept monitoring requests from hut + iptables -A nixos-fw -p tcp -s hut -m multiport --dport 9283,9002 -j nixos-fw-accept + # Accept all Ceph traffic from the local network + iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept + ''; + }; }; services.ceph = { diff --git a/m/lake2/configuration.nix b/m/lake2/configuration.nix index aacf5b9..934f6f7 100644 --- a/m/lake2/configuration.nix +++ b/m/lake2/configuration.nix @@ -45,6 +45,14 @@ address = "10.0.42.42"; prefixLength = 24; } ]; + firewall = { + extraCommands = '' + # Accept all incoming TCP traffic from bay + iptables -A nixos-fw -p tcp -s bay -j nixos-fw-accept + # Accept monitoring requests from hut + iptables -A nixos-fw -p tcp -s hut --dport 9002 -j nixos-fw-accept + ''; + }; }; # Missing service for volumes, see: