Skip to content

Instantly share code, notes, and snippets.

Last active April 19, 2021 03:04
Show Gist options
  • Save jimmycuadra/fe79ae8857f3f0d0cae1 to your computer and use it in GitHub Desktop.
Save jimmycuadra/fe79ae8857f3f0d0cae1 to your computer and use it in GitHub Desktop.
CoreOS cloud-config for DigitalOcean with iptables firewall
# generate a new token for each unique cluster from
# multi-region deployments, multi-cloud deployments, and droplets without
# private networking need to use $public_ipv4
addr: $private_ipv4:4001
peer-addr: $private_ipv4:7001
public-ip: $private_ipv4
- name: etcd.service
command: start
- name: fleet.service
command: start
- name: iptables-restore.service
enable: true
- path: /var/lib/iptables/rules-save
permissions: 0644
owner: root:root
content: |
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
Copy link

Dynom commented Jul 28, 2015

Additional note, unrelated to the subject at hand (Iptables) is that this file references Etcd and not the more recent Etcd2. This can result in a very weird situation. Be explicit in what version you want (Etcd2 is preferred) and don't reference the other version or you might get two Etcd instances fighting for the cluster.

See also: etcd-io/etcd#3103

Copy link

sjlu commented Oct 16, 2015

@oliver006 did you ever find a solution to locking down the private networking interface?

Copy link

I came up with a file that addresses some of the concerns mentioned here and fixes another problem that I was having. iptables doesn't seem to want to start if the rules-save file doesn't end with a newline. I was not successful in coming up with a cloud-config that would write a newline but it turns out that a comment line works as well:

If anyone sees any problems with my cloud-config, please let me know.

Copy link

@sjlu @socketwiz @oliver006 Any solution found for the private network security concern?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment