X-Git-Url: https://git.hcoop.net/hcoop/zz_old/debian/hcoop-firewall-config.git/blobdiff_plain/4c7f0eaa100a9644f00e0326acc90ed6c6d75d8a..2843401b4f128e1aa51cd210488cf3744e679555:/files/ferm.conf.hcoop

diff --git a/files/ferm.conf.hcoop b/files/ferm.conf.hcoop
index 3a6b659..24f2adf 100644
--- a/files/ferm.conf.hcoop
+++ b/files/ferm.conf.hcoop
@@ -40,6 +40,9 @@ table filter {
         #mod state state INVALID DROP;
         mod state state (ESTABLISHED RELATED) ACCEPT;
 
+	# Allow ping
+	proto icmp ACCEPT;
+
 	proto tcp dport ssh ACCEPT;
 
         # connections to domtool dispatcher and slaves (for e.g. QFoo)
@@ -58,6 +61,11 @@ table filter {
 	# access. We'll leave that for the wheezy machines.
 	proto tcp dport smtp daddr mail.hcoop.net ACCEPT;
 
+	# At least for now, open ports to database servers. If dbtool
+	# adduser could also add firewall rules, that would be better.
+	proto (tcp udp) dport mysql daddr mysql.hcoop.net ACCEPT;
+	proto (tcp udp) dport (postgresql 5433) daddr postgres.hcoop.net ACCEPT;
+
         # root needs port 80 for things like apt-get
 	mod owner uid-owner 0 { proto (tcp) dport (http https) ACCEPT; }