services:networking
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
services:networking [2026/08/11 19:48] djgalloway |
services:networking [2026/08/11 19:51] (current) djgalloway [Firewall Rules] |
||
|---|---|---|---|
| Line 32: | Line 32: | ||
| IBM OneIT manages the Juniper SRX in front of the lab. | IBM OneIT manages the Juniper SRX in front of the lab. | ||
| - | ^ Application Name ^ Rule Type ^ Source IP or Subnet/CIDR ^ Destination IP or Subnet/CIDR ^ Port Number ^ Protocol ^ | + | ^ Application Name ^ Inbound/Outbound ^ Destination IP or Subnet/CIDR ^ Port Number ^ Protocol ^ |
| - | | OpenVPN | Network to host | 0.0.0.0/0 | 192.86.31.5 | udp-1194 \\ udp-51820 | UDP | | + | | OpenVPN | Inbound | 192.86.31.5 | udp-1194 \\ udp-51820 | UDP | |
| - | | OpenVPN | Network to host | 0.0.0.0/0 | 192.86.31.12 | 1194 | UDP | | + | | OpenVPN | Inbound | 192.86.31.12 | 1194 | UDP | |
| - | | nginx / file share (e.g., [[https://filedump.ceph.com/]]) | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | nginx / file share (e.g., https://filedump.ceph.com/) | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | GitWeb | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | GitWeb | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | githelper ([[https://github.com/ceph/githelper]]) | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | githelper (https://github.com/ceph/githelper) | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | Etherpad (pad.ceph.com) | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | Etherpad (pad.ceph.com) | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | Pulpito ([[https://github.com/ceph/pulpito]]) | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | Pulpito (https://github.com/ceph/pulpito) | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | qa-proxy.ceph.com | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | qa-proxy.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | quay.ceph.io | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | quay.ceph.io | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | sentry.ceph.com | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | sentry.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | teuthology-api.ceph.com | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | teuthology-api.ceph.com | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | Dokuwiki (wiki.sepia.ceph.com) | Network to host | 0.0.0.0/0 | 192.86.31.5 | 443 | TCP | | + | | Dokuwiki (wiki.sepia.ceph.com) | Inbound | 192.86.31.5 | 443 | TCP | |
| - | | Postorius & Hyperkitty | Network to host | 0.0.0.0/0 | 192.86.31.12 | 443 | TCP | | + | | Postorius & Hyperkitty | Inbound | 192.86.31.12 | 443 | TCP | |
| - | | Postfix (Ceph project mailing lists) | Network to host | 0.0.0.0/0 | 192.86.31.12 | 25 | TCP | | + | | Postfix (Ceph project mailing lists) | Inbound | 192.86.31.12 | 25 | TCP | |
| - | | telemetry.ceph.com (apache2) | Network to host | 0.0.0.0/0 | 192.86.31.13 | 443 | TCP | | + | | telemetry.ceph.com (apache2) | Inbound | 192.86.31.13 | 443 | TCP | |
| - | | telemetry-public.ceph.com (nginx serving grafana) | Network to host | 0.0.0.0/0 | 192.86.31.14 | 443 | | | + | | telemetry-public.ceph.com (nginx serving grafana) | Inbound | 192.86.31.14 | 443 | | |
| - | | chacra.ceph.com (nginx) | Network to host | 0.0.0.0/0 | 192.86.31.15 | 443 | TCP | | + | | chacra.ceph.com (nginx) | Inbound | 192.86.31.15 | 443 | TCP | |
| - | | INBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,53,69,111,389,NFS,Management,DB,ExplicitlyDenied | | 0.0.0.0/0 | 192.86.31.5-254 | | | | + | | INBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,53,69,111,389,NFS,Management,DB,ExplicitlyDenied | Inbound | 192.86.31.5-254 | | | |
| - | | Outbound web traffic | Network to network | Lab/NAT | 0.0.0.0/0 | 443 | | | + | | Outbound web traffic | Outbound | 0.0.0.0/0 | 443 | | |
| - | | Jenkins agent SSH to Jenkins controller | Network to host | Lab/NAT | 158.69.68.47 | 2222 | | | + | | Jenkins agent SSH to Jenkins controller | Outbound | 158.69.68.47 | 2222 | | |
| - | | Jenkins agent SSH to Jenkins controller | Network to host | Lab/NAT | 158.69.65.239 | 2222 | | | + | | Jenkins agent SSH to Jenkins controller | Outbound | 158.69.65.239 | 2222 | | |
| - | | rsync unsigned packages from chacra.ceph.com | Network to host | Lab/NAT | 192.86.31.15 | 2222 | | | + | | rsync unsigned packages from chacra.ceph.com | Outbound | 192.86.31.15 | 2222 | | |
| - | | rsync signed packages to download.ceph.com | Network to host | Lab/NAT | 158.69.68.124 | 22 | | | + | | rsync signed packages to download.ceph.com | Outbound | 158.69.68.124 | 22 | | |
| - | | OUTBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,69,111,389,NFS,Management,DB,ExplicitlyDenied | Network to host | Lab/NAT | 0.0.0.0/0 | | | | + | | OUTBOUND OKAY TO BLOCK: 20,21,23,830,3389,58xx,59xx,69,111,389,NFS,Management,DB,ExplicitlyDenied | Outbound | 0.0.0.0/0 | | | |
| - | | All non-blocklisted ports | Network to Network | Lab/NAT | 0.0.0.0/0 | All | All | | + | | All non-blocklisted ports | Outbound | 0.0.0.0/0 | All | All | |
| - | | All, unrestricted | Network to Network | 0.0.0.0/0 | 0.0.0.0/0 | All | All | | + | | All, unrestricted | Outbound | 0.0.0.0/0 | All | All | |
| - | Firewall rules can be updated by following https://w3.ibm.com/w3publisher/oneit/nw-support/next-generation-datacenter/firewall-rules | + | Firewall rules can be updated by following https://w3.ibm.com/w3publisher/oneit/nw-support/next-generation-datacenter/firewall-rules. |
| + | |||
| + | IES keeps [[https://ibm.box.com/s/in756ga4nfv79swvhj0btwv5bitxc95s|this spreadsheet]] up to date and should be considered the source of truth over this wiki article. | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
services/networking.1786477734.txt.gz · Last modified: 2026/08/11 19:48 by djgalloway
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
