0

I'm using puppetlabs firewall module and I'm having troubles setting up iptables for a simple web host.

I'm following this guide and want to set up additional rules. https://sysadmincasts.com/episodes/18-managing-iptables-with-puppet

For example, I've added rules to allow outgoing traffic with git and mysql ports:

  firewall { '200 allow outgoing mysql':
    chain   => 'OUTPUT',
    state   => ['NEW'],
    proto   => 'tcp',
    dport    => '3306',
    action  => 'accept',
  }

  firewall { '200 allow outgoing git':
    chain => 'OUTPUT',
    state => ['NEW'],
    dport => '9418',
    proto => 'tcp',
    action => 'accept',
  }

and looking in iptables, I can see the following rules:

root@app01:~/geppetto# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* 000 accept all icmp */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* 001 accept all to lo interface */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* 003 accept related established rules */ state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80 /* 200 allow incoming http */ state NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22 /* 200 allow openssh */ state NEW
LOG        all  --  0.0.0.0/0            0.0.0.0/0            /* 900 log dropped input chain */ LOG flags 0 level 6 prefix "[IPTABLES INPUT] dropped "
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* 910 deny all other input requests */

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  0.0.0.0/0            0.0.0.0/0            /* 900 log dropped forward chain */ LOG flags 0 level 6 prefix "[IPTABLES FORWARD] dropped "
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* 910 deny all other forward requests */

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            /* 004 accept related established rules */ state RELATED,ESTABLISHED
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 53 /* 200 allow outgoing dns lookups */ state NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 9418 /* 200 allow outgoing git */ state NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80 /* 200 allow outgoing http */ state NEW
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            /* 200 allow outgoing icmp type 8 (ping) */ icmptype 8
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 3306 /* 200 allow outgoing mysql */ state NEW
LOG        all  --  0.0.0.0/0            0.0.0.0/0            /* 900 log dropped output chain */ LOG flags 0 level 6 prefix "[IPTABLES OUTPUT] dropped "
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* 910 deny all other output requests */

However, I can't access anything with git from the machine. Running git fetch origin just times out. Do I have to set up some rules for the outgoing source port as well? Thanks in advance!

2
  • 1
    Are you sure you aren't using git over ssh? Apr 24, 2015 at 15:59
  • I ssh to my server (where I have the iptables rules) and run git from there (using git not https)
    – gerky
    Apr 24, 2015 at 17:04

1 Answer 1

2

There are several protocols that Git can use, which are documented here - the most common of which is SSH, which is used on GitHub (both public and Enterprise flavours) as well as Gitosis and Gitolite.

To use Git over SSH, you will need to open port 22 outbound, and to use the much rarer Git protocol, you'll need to open port 9418, which you already have, so the chances are that you are actually using an SSH Git URL.

Example: [email protected]:craigwatson/puppet-vmwaretools.git

3
  • excellent, that was it. I'm not sure why it's using ssh though even though I see git@ when running git remote -v.
    – gerky
    Apr 25, 2015 at 16:42
  • In SSH parlance, [email protected] is connecting to host.com as the user git. Apr 25, 2015 at 17:05
  • d'oh I confused it with git://
    – gerky
    Apr 25, 2015 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .