blob: a7c2ad1fdea109e3a590122a17b30b66f73e911d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
#!/bin/bash
private_network_cidr="${1}"
public_network_cidrs="${2}"
for name in default-grp; do
openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
for protocol in tcp udp; do
if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv4'" == "" ]; then
openstack security group rule create --egress --protocol ${protocol} --remote-ip 0.0.0.0/0 --dst-port 1:65535 --ethertype IPv4 ${name} >/dev/null 2>&1
fi
if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv6'" == "" ]; then
openstack security group rule create --egress --protocol ${protocol} --remote-ip ::/0 --dst-port 1:65535 --ethertype IPv6 ${name} >/dev/null 2>&1
fi
done
for cidr in ${private_network_cidr} ${public_network_cidrs}; do
if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"icmp\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
openstack security group rule create --ingress --protocol icmp --remote-ip ${cidr} ${name} >/dev/null 2>&1
fi
done
for port in 22; do
for cidr in ${private_network_cidr} ${public_network_cidrs}; do
if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
fi
done
done
done
for name in dns; do
openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
for port in 53; do
for cidr in ${private_network_cidr} ${public_network_cidrs}; do
if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
openstack security group rule create --ingress --protocol udp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
fi
done
done
done
for name in vertx; do
openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
for port in 5701:5710; do
for cidr in ${private_network_cidr}; do
if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
fi
done
done
done
for name in web; do
openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
for port in 8080:8083; do
for cidr in ${private_network_cidr} ${public_network_cidrs}; do
if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
fi
done
done
done
for name in galera; do
openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
for port in 3306 4444 4567 9200; do
for cidr in ${private_network_cidr} ${public_network_cidrs}; do
if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
fi
done
done
done
exit 0
|
