scissor-project / open-scissor

OpenSCISSOR provisioning and orchestration
Apache License 2.0
2 stars 0 forks source link

Saved prelude-manager-oss iptables rules after reload #40

Closed agil3b3ast closed 6 years ago

agil3b3ast commented 6 years ago

Used iptables-services to save iptables rules

We use only iptables and not firewalld

Description of the Change

Saved prelude-manager-oss iptables rules after reload.

Alternate Designs

N/A

Benefits

After this, prelude-manager's iptables rules persist even if vagrant reload prelude-manager-oss is executed.

Possible Drawbacks

N/A

Applicable Issues

38

agil3b3ast commented 6 years ago

@ferrarimarco i did not understand your request, what should i keep in this pull request?

ferrarimarco commented 6 years ago

You are addressing two separate issues here:

  1. Save iptables rules and restore them when needed
  2. Start prelude-manager as a service

According to me these two aspects should be dealt with in separate PRs. So one to manage iptables and one to configure the prelude-manager service.

After reading your comment I have a clearer picture. Maybe it's better to keep iptables bits here and create a separate issue and PR for the prelude-manager service configure.

Thoughts?

EDIT: I created an issue for you #41, to track the configuration of the prelude-manager service.

So to sum it up:

  1. Keep this PR (#40) to configure iptables (to fix #38)
  2. Open a new PR to fix #41. In this PR you should move the configuration of prelude-manager service

Is it fine with you?

agil3b3ast commented 6 years ago

Ok @ferrarimarco i will add the rest of the code in #41 . Actually prelude-manager is already running as a service, but running before maria-db is necessary to be resilient to reboots.

ferrarimarco commented 6 years ago

LGTM

This is the output after a vagrant reload prelude-manager-oss

[vagrant@prelude-manager-oss ~]$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --dport 5553 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4690 -j ACCEPT