Disable external firewall for ildkule in openstack #286
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Drift/issues#286
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
There seems to be some sort of invisible firewall outside of ildkule. Ildkule already has iptables active, so we don't need two layers of firewall.
(Note that I am not 100% sure that this is actually the case, but I'm having trouble connecting to allegedly open ports on ildkule, and I don't have access to openstack to verify it)
Using the OpenStack firewall is free real estate without using VM resources, and can't be changed by someone hacking into ildkule (publicly exposed grafana 💀), and I think we landed on doing it this way after discussing when setting it up. Unlike proxmox, where the firewall is annoying, the OpenStack one is nice, and I like it.
However, if someone wants to modify it, add some rules, or open up everything, there are guides
You also have to have an NTNU account, be in the something-something-openstack-pvv unix group (ask @danio), and be on some sort of NTNU network/ip range to access StackIT. This alone, and us not having NTNU accounts, might be a fair argument to open this up a bit.
Could we at the very least allow unconditional traffic from PVV's IPv4 and IPv6 space? The firewall can be as nice as it wants to, but it doesn't matter if neither of us have access to it.