0

I'm a little confused and could use some clarification.

Let's say I want to deny all connections to a mongodb server, except for to SSH from my IP and from my IP to port 27017. The way I understand it I would first set the allow rules, and then the general deny rules

ufw allow from MY_IP to any port 22
ufw allow from MY_IP to any port 27017
ufw deny 22
ufw deny 27017

This makes sense. But now, say I am running a cluster of application servers that all need access to the database server, and the these servers may be created or destroyed at anytime automatically, meaning that the ips that will be allowed will be changing. Do I have to delete the general deny rules everytime I want to add a new allow to a specific application server and then recreate them?

1 Answer 1

0

You can use UFW/iptables to allow ranges.
If your servers are created within the same range, you setup specific subnets to be allowed through. example:

ufw allow in on eth0 from 192.168.4.0/24 proto tcp to any port 1234
1
  • in my case specifically I am using private networking on digital ocean to connect my machines and the given ips are not in a reliable range. Nov 8, 2014 at 3:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .