Skip to content

Instantly share code, notes, and snippets.

@socketwiz
Last active April 6, 2018 06:51
Show Gist options
  • Save socketwiz/d6fe23d19180a1ad8b5a to your computer and use it in GitHub Desktop.
Save socketwiz/d6fe23d19180a1ad8b5a to your computer and use it in GitHub Desktop.
CoreOS cloud-config for DigitalOcean with iptables firewall
#cloud-config
coreos:
etcd2:
# generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3
# specify the initial size of your cluster with ?size=X
discovery: https://discovery.etcd.io/<token>
# multi-region and multi-cloud deployments need to use $public_ipv4
advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001
initial-advertise-peer-urls: http://$private_ipv4:2380
# listen on both the official ports and the legacy ports
# legacy ports can be omitted if your application doesn't depend on them
listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
listen-peer-urls: http://$private_ipv4:2380
fleet:
public-ip: $private_ipv4 # used for fleetctl ssh command
units:
- name: etcd2.service
command: start
- name: fleet.service
command: start
- name: iptables-restore.service
enable: true
command: start
write_files:
- path: /var/lib/iptables/rules-save
permissions: 0644
owner: 'root:root'
content: |
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth1 -p tcp -s 10.132.0.0/16,172.17.0.0/16,127.0.0.1 --dport 4001 -j ACCEPT
-A INPUT -i eth1 -p tcp -s 10.132.0.0/16,172.17.0.0/16,127.0.0.1 --dport 2379 -j ACCEPT
-A INPUT -i eth1 -p tcp -s 10.132.0.0/16,172.17.0.0/16,127.0.0.1 --dport 2380 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
COMMIT
# the last line of the file needs to be a blank line or a comment
@socketwiz
Copy link
Author

To create a token: curl -w "\n" "https://discovery.etcd.io/new?size=3"

Where 3 is set to the number of hosts you are going to create. If you don't create at least that many hosts etcd2 will not come up.

@robyoung
Copy link

I think -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT should be -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT. The ICMP type 0 is for the echo response which is allowed by the OUTPUT ACCEPT. See http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

Incidentally human names can be provided for the ICMP types (echo-request, destination-unreachable and time-exceeded).

@nmdias
Copy link

nmdias commented Jan 22, 2017

@socketwiz where are you defining the $private_ipv4 variable? I can't seem to find documentation on using variables. Could you point me in the right direction?

@thomaswardiii
Copy link

thomaswardiii commented Jan 31, 2017

@nmdias $private_ipv4 is a substituted variable that DigitalOcean replaces on their own. It's not and should not be defined by the user, but rather is replaced with the droplet's Private IPv4 address by DigitalOcean's infrastructure that creates the droplets

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment