Bug 1006040

Description of problem:
The firewalling described in the Deployment Guide isn't very useful. I think it would more helpful to give more detailed examples like the  ones given in the OpenShift Reference Architecture document.

Specifically, [1] from http://www.redhat.com/resourcelibrary/reference-architectures/deploying-and-managing-a-private-paas-with-openshift-enterprise

[1]  7.Configure the firewall for MongoDB traffic on each BSN host to only allow traffic from
the broker hosts and the other BSN hosts, no other. Even with this traffic being restricted,
the version of MongoDB shipped with this solution is not complied with SSL support. So all
traffic is transmitted via clear text. One other option is to also implement SSH tunnels in-
between the hosts to secure the traffic even further.

bsn1:
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.25 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.26 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.27 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.31 --dport 27017
--jump ACCEPT
# service iptables save
bsn2:
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.25 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.26 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.28 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.31 --dport 27017
--jump ACCEPT
# service iptables save
bsn3:
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.25 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.26 --dport 27017
--jump ACCEPT
refarch-feedback
29
www.redhat.com
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.27 --dport 27017
--jump ACCEPT
#
iptables -I INPUT -i eth0 -p tcp --source 10.16.138.28 --dport 27017
--jump ACCEPT
# service iptables save
There are different ways to open and close firewall ports on Red Hat Enterprise Linux, this
method uses lokkit, one other method is viaiptables.


Additional info:
The method pointed out from the reference arch uses iptables commands specifically not lokkit. lokkit is a very basic (almost too basic) way to configure a firewall (iptables). The method in the reference arch is much more robust and secure. I don't believe that can be achieved with lokkit. The ref arch is not only isolating ports but to specific hosts.