The firewall rules are spread around all puppet manifests and should be put into the openstack::firewall

[Bogdan Dobrelya]

We have following places for firewall rules in manifests (look for all "firewall {}" entries):
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/openstack/manifests/firewall.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/openstack/manifests/heat.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/openstack/manifests/logging.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/cobbler/manifests/iptables.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/sahara/manifests/init.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/memcached/manifests/init.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/zabbix/manifests/server.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/zabbix/manifests/monitoring/rabbitmq_mon.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/zabbix/manifests/agent.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/osnailyfacter/modular/firewall/firewall.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/nailgun/manifests/host.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/nailgun/manifests/iptables.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/galera/manifests/init.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/mongodb/manifests/firewall.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/ceph/manifests/radosgw.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/ceph/manifests/osd.pp
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/ceph/manifests/mon.pp

And the list actually should be only:
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/openstack/manifests/firewall.pp

https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/cobbler/manifests/iptables.pp

https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/nailgun/manifests/host.pp (?)
https://github.com/stackforge/fuel-library/blob/master/deployment/puppet/nailgun/manifests/iptables.pp

Also note, that openstack/manifests/firewall.pp should contain if {} stanzas for different types of deployment (ceph or swift, for example. Nova or neutron, etc.) in order to not open unused ports.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/227809

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/227809
Committed: https://git.openstack.org/cgit/stackforge/fuel-library/commit/?id=c1553933e0aea410cd63b92f63b778049d2e68a6
Submitter: Jenkins
Branch: master

commit c1553933e0aea410cd63b92f63b778049d2e68a6
Author: Stanislaw Bogatkin <email address hidden>
Date: Fri Sep 25 15:00:15 2015 +0300

    Move some firewall rules

    Place rules for mongo and heat to more appropriate places.

    Change-Id: I987564e68c42b87ac16aecec2404a365e7fec85f
    Closes-Bug: #1429077

[Tatyanka (tatyana-leontovich)]

verified on 529