controller iptables rules open ports on all IPs

[Oliver Walsh]

All of the iptables rules on the controller open the given ports on all src/dst IPs and interfaces. Ideally the rules would limit connections to the appropriate subnet.

For example:
[root@overcloud-controller-0 heat-admin]# iptables -L -n | grep 0.0.0.0 | grep redis
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 6379,26379 /* 108 redis */ state NEW

There is nobody listening in this case. Redis binds to the node IP & haproxy binds to the VIP on the provisioning network:

[root@overcloud-controller-0 heat-admin]# netstat -nltp | grep 6379
tcp 0 0 192.0.2.17:6379 0.0.0.0:* LISTEN 36168/redis-server
tcp 0 0 192.0.2.15:6379 0.0.0.0:* LISTEN 27149/haproxy

[Emilien Macchi (emilienm)]

There are no currently open reviews on this bug, changing the status back to the previous state and unassigning. If there are active reviews related to this bug, please include links in comments.

[Emilien Macchi (emilienm)]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (FUTURE, PIKE, QUEENS, ROCKY, STEIN).
  Valid example: CONFIRMED FOR: FUTURE