From dfa58f6089af0082a62f83d637fe7caaac5ed461 Mon Sep 17 00:00:00 2001 From: Tim Sogard Date: Thu, 20 Dec 2018 02:27:37 -0500 Subject: [PATCH] Allow hosts to communicate with prometheus exporters --- files/firewall | 3 +++ 1 file changed, 3 insertions(+) diff --git a/files/firewall b/files/firewall index c63479d..b9d3612 100755 --- a/files/firewall +++ b/files/firewall @@ -101,6 +101,9 @@ case $1 in ip6tables -A INPUT -s 2604:bbc0:0:113::1 -p udp --sport 53 -j ACCEPT # dns replies from bastion ip6tables -A INPUT -s 2604:bbc0:0:113::b -p tcp --dport 22 -j ACCEPT # ssh from bastion2 ip6tables -A INPUT -s 2604:bbc0:0:113::b -p udp --sport 53 -j ACCEPT # dns replies from bastion2 + ip6tables -A INPUT -s 2600:1f14:3f:1b01:e296:593a:484a:64d2 -p tcp --sport 9091 -j ACCEPT # prometheus pushgateway + ip6tables -A INPUT -s 2600:1f14:3f:1b01:e296:593a:484a:64d2 -p tcp --sport 9103 -j ACCEPT # prometheus collectd-exporter + ## traffic we want to see encrypted over the VPN ip6tables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 22 -j ACCEPT # ssh if coming over the VPN