services:networking
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
services:networking [2026/05/07 15:03] djgalloway |
services:networking [2026/08/11 19:51] (current) djgalloway [Firewall Rules] |
||
|---|---|---|---|
| Line 27: | Line 27: | ||
| [[services:DNS]] and [[services:DHCP]] were configured to manage these VLANs in https://github.com/ceph/ceph-sepia-secrets/pull/463. | [[services:DNS]] and [[services:DHCP]] were configured to manage these VLANs in https://github.com/ceph/ceph-sepia-secrets/pull/463. | ||
| + | |||
| + | ===== Firewall Rules ===== | ||
| + | |||
| + | IBM OneIT manages the Juniper SRX in front of the lab. | ||
| + | |||
| + | ^ Application Name ^ Inbound/Outbound ^ Destination IP or Subnet/CIDR ^ Port Number ^ Protocol ^ | ||
| + | | OpenVPN | Inbound | 192.86.31.5 | udp-1194 \\ udp-51820 | UDP | | ||
| + | | OpenVPN | Inbound | 192.86.31.12 | 1194 | UDP | | ||
| + | | nginx / file share (e.g., https://filedump.ceph.com/) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | GitWeb | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | githelper (https://github.com/ceph/githelper) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Etherpad (pad.ceph.com) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Pulpito (https://github.com/ceph/pulpito) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | qa-proxy.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | quay.ceph.io | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | sentry.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | teuthology-api.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Dokuwiki (wiki.sepia.ceph.com) | Inbound | 192.86.31.5 | 443 | TCP | | ||
| + | | Postorius & Hyperkitty | Inbound | 192.86.31.12 | 443 | TCP | | ||
| + | | Postfix (Ceph project mailing lists) | Inbound | 192.86.31.12 | 25 | TCP | | ||
| + | | telemetry.ceph.com (apache2) | Inbound | 192.86.31.13 | 443 | TCP | | ||
| + | | telemetry-public.ceph.com (nginx serving grafana) | Inbound | 192.86.31.14 | 443 | | | ||
| + | | chacra.ceph.com (nginx) | Inbound | 192.86.31.15 | 443 | TCP | | ||
| + | | INBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,53,69,111,389,NFS,Management,DB,ExplicitlyDenied | Inbound | 192.86.31.5-254 | | | | ||
| + | | Outbound web traffic | Outbound | 0.0.0.0/0 | 443 | | | ||
| + | | Jenkins agent SSH to Jenkins controller | Outbound | 158.69.68.47 | 2222 | | | ||
| + | | Jenkins agent SSH to Jenkins controller | Outbound | 158.69.65.239 | 2222 | | | ||
| + | | rsync unsigned packages from chacra.ceph.com | Outbound | 192.86.31.15 | 2222 | | | ||
| + | | rsync signed packages to download.ceph.com | Outbound | 158.69.68.124 | 22 | | | ||
| + | | OUTBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,69,111,389,NFS,Management,DB,ExplicitlyDenied | Outbound | 0.0.0.0/0 | | | | ||
| + | | All non-blocklisted ports | Outbound | 0.0.0.0/0 | All | All | | ||
| + | | All, unrestricted | Outbound | 0.0.0.0/0 | All | All | | ||
| + | |||
| + | Firewall rules can be updated by following https://w3.ibm.com/w3publisher/oneit/nw-support/next-generation-datacenter/firewall-rules. | ||
| + | |||
| + | IES keeps [[https://ibm.box.com/s/in756ga4nfv79swvhj0btwv5bitxc95s|this spreadsheet]] up to date and should be considered the source of truth over this wiki article. | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
services/networking.1778166187.txt.gz · Last modified: 2026/05/07 15:03 by djgalloway
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
