Archived
beatzaplenty
a854412117
Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path, Ceph as the future HA storage upgrade, and baseline SSH/firewall hardening.
32 lines
1.0 KiB
Plaintext
32 lines
1.0 KiB
Plaintext
# Example cluster-wide firewall rules for /etc/pve/firewall/cluster.fw
|
|
#
|
|
# Placeholders to fill in once the network is built:
|
|
# <MGMT_CIDR> - management VLAN/subnet, e.g. 192.168.10.0/24
|
|
# <COROSYNC_CIDR> - corosync VLAN/subnet
|
|
# <CEPH_CIDR> - Ceph public + backend VLAN/subnet (once Ceph is live)
|
|
#
|
|
# Copy to /etc/pve/firewall/cluster.fw and edit before enabling.
|
|
|
|
[OPTIONS]
|
|
enable: 1
|
|
policy_in: DROP
|
|
policy_out: ACCEPT
|
|
|
|
[IPSET mgmt]
|
|
<MGMT_CIDR>
|
|
|
|
[RULES]
|
|
# Web UI + SSH only from the management network
|
|
IN ACCEPT -source +mgmt -p tcp -dport 8006 -log nolog
|
|
IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog
|
|
|
|
# Corosync (cluster quorum) - nodes only, restrict source to the
|
|
# corosync subnet once it's provisioned
|
|
IN ACCEPT -source <COROSYNC_CIDR> -p udp -dport 5404:5405 -log nolog
|
|
|
|
# Ceph (uncomment once Ceph is live; ports: mon 3300,6789, osd/mgr/mds
|
|
# 6800-7300)
|
|
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 3300 -log nolog
|
|
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6789 -log nolog
|
|
# IN ACCEPT -source <CEPH_CIDR> -p tcp -dport 6800:7300 -log nolog
|