From 727eef9fdc54a7389929495ddc6007dcacf3fd36 Mon Sep 17 00:00:00 2001 From: Grant Slater Date: Fri, 9 Aug 2013 11:49:48 +0100 Subject: [PATCH] Tilecache: Firewall allow ICP traffic between caches --- cookbooks/tilecache/recipes/default.rb | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/cookbooks/tilecache/recipes/default.rb b/cookbooks/tilecache/recipes/default.rb index 5b44be21f..18aa14e14 100644 --- a/cookbooks/tilecache/recipes/default.rb +++ b/cookbooks/tilecache/recipes/default.rb @@ -21,6 +21,27 @@ include_recipe "squid" tilecaches = search(:node, "roles:tilecache").sort_by { |n| n[:hostname] } +tilecaches.each do |cache| + cache.ipaddresses(:family => :inet, :role => :external).sort.each do |address| + firewall_rule "accept-squid" do + action :accept + source "net:#{address}" + dest "fw" + proto "tcp:syn" + dest_ports "3128" + source_ports "1024:" + end + firewall_rule "accept-squid-icp" do + action :accept + source "net:#{address}" + dest "fw" + proto "udp" + dest_ports "3130" + source_ports "1024:" + end + end +end + squid_fragment "tilecache" do template "squid.conf.erb" variables :caches => tilecaches -- 2.43.2