tighten up firewall rules for ssh

CCI-MOC · Nov 2, 2018 · 7ef757b · 7ef757b · larsks · Nov 3, 2018
1 parent 40a6085
commit 7ef757b
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/templates/deploy.yaml b/templates/deploy.yaml
@@ -146,10 +146,18 @@ parameter_defaults:
 
   ExtraConfig:
     tripleo::firewall::firewall_rules:
-      '003 accept ssh from provisioning network':
+      '002 accept ssh from provisioning network ipv4':
         dport: 22
         proto: 'tcp'
-        source: 172.16.0.0/22
+        source: 172.16.0.0/19
+      '002 accept ssh from vpn network ipv4':
+        dport: 22
+        proto: 'tcp'
+        source: 172.31.224.0/19
+      '002 reject all other ssh traffic ipv4':
+        dport: 22
+        proto: 'tcp'
+        action: drop
     nova::compute::libvirt::libvirt_cpu_mode: host-passthrough
 
   SSLCertificate: |