I'm using a Galera cluster between a few web servers over the WAN. I have the traffic encrypted with ipsec between the servers, but it just struck me that anyone can connect to my Galera cluster and start downloading the database.
What would be the best way to protect my self against this? Is it possible to set some sort of authentication (e.g. a password) or only allow certain IP's to join the cluster in Maria DB?
(I'm aware Galera has support for SSL, but since I already use ipsec for secure server to server communication I don't want to have the extra overhead of encrypting things twice.)
The current option I came up with is using iptables to block the port for Galera and only allow certain IP's.