51 lines
2.1 KiB
Markdown
51 lines
2.1 KiB
Markdown
# Firewalls
|
|
|
|
When providing resources on your host, whether
|
|
[network](./contributing-a-public-address.md) or
|
|
[storage](./contributing-storage.md), you will need to ensure that your
|
|
host's firewall is configured correctly to do so.
|
|
|
|
To make matters even more confusing, there are actually two firewalls at play:
|
|
the host's firewall, and the VPN firewall.
|
|
|
|
## VPN Firewall
|
|
|
|
Isle uses the [nebula](https://github.com/slackhq/nebula) project to
|
|
provide its VPN layer. Nebula ships with its own [builtin
|
|
firewall](https://nebula.defined.net/docs/config/firewall), which only applies
|
|
to connections coming in over the virtual network interface which it creates.
|
|
This firewall can be manually configured using the `isle vpn firewall` set of
|
|
sub-commands, or using the [configuration file][configfile].
|
|
|
|
Any storage allocations which are defined will have their network ports
|
|
automatically added to the VPN firewall by Isle. This means that you only need
|
|
to configure the VPN firewall if you are hosting services for your isle network
|
|
besides storage.
|
|
|
|
## Host Firewall
|
|
|
|
The host you are running isle on will almost definitely have a firewall
|
|
running, separate from the VPN firewall. If you wish to provide services for
|
|
your Isle network from your host, you will need to allow their ports in your
|
|
host's firewall.
|
|
|
|
**isle does _not_ automatically configure your host's firewall to any extent!**
|
|
|
|
One option is to open your host to all traffic from your Isle network, and
|
|
allow the VPN firewall to be fully responsible for filtering traffic. To do this
|
|
on Linux using iptables, for example, you would add something like this to your
|
|
iptables configuration:
|
|
|
|
```
|
|
-A INPUT --source <network CIDR> --jump ACCEPT
|
|
```
|
|
|
|
being sure to replace the network CIDR with the one for your network.
|
|
|
|
If you don't feel comfortable allowing nebula to deal with all packet filtering,
|
|
you will need to manually determine and add the ports for each nebula service to
|
|
your host's firewall. You will need to manually specify any configured storage
|
|
allocation ports if this is the approach you take.
|
|
|
|
[configfile]: ./configuring-networks.md
|