firewall.conf

#!/bin/bash

# Flush any current firewall settings
iptables -F

# Allow all established connections 
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow all loopback traffic
iptables -I INPUT 1 -i lo -j ACCEPT

# Allow all SSH traffic 
iptables -A INPUT -p tcp --dport ssh -j ACCEPT

# Allow for all traffic from anywhere for the following services
iptables -A INPUT -p tcp --dport 80 -j ACCEPT          # nginx / AppLoadBalancer
iptables -A INPUT -p tcp --dport 443 -j ACCEPT         # nginx (SSL)
iptables -A INPUT -p tcp --dport 6106 -j ACCEPT        # BlobServer
iptables -A INPUT -p tcp --dport 8050 -j ACCEPT        # AppMonitoring
iptables -A INPUT -p tcp --dport 8078 -j ACCEPT        # Sisyphus
iptables -A INPUT -p tcp --dport 8080:8100 -j ACCEPT   # nginx -> Google App Engine
iptables -A INPUT -p tcp --dport 4380:4400 -j ACCEPT   # nginx -> Google App Engine (SSL)
iptables -A INPUT -p tcp --dport 17443 -j ACCEPT       # AppController
iptables -A INPUT -p tcp --dport 17445 -j ACCEPT       # NeptuneManager
iptables -A INPUT -p tcp --dport 4343 -j ACCEPT        # UserAppServer

ALL_IPS_FILE=/etc/appscale/all_ips
MASTER_FILE=/etc/appscale/masters
SLAVES_FILE=/etc/appscale/slaves

# Allow any connections between AppScale nodes
cat $ALL_IPS_FILE $MASTER_FILE $SLAVES_FILE | sort -u | while read line; do
  test -n "$line" && iptables -A INPUT -s ${line} -j ACCEPT
done

# Drop all other connections
iptables -A INPUT -j DROP