Firewall Service

Note

This site belongs to the IP firewall. There is also a web application firewall which is described within Website Service

Default settings

By default, all incoming and outgoing traffic is blocked, except the following:

related or established connections
ICMP/ICMPv6
Traceroute
SSH

Custom rules trough service

Where applicable, all services add the approriate firewall rules automatically, for example:

website module will allow HTTP/HTTPS
mysql type in database module will allow mysql from admin server

Custom rules

Where applicable, both IPv4 and IPv6 Rules are added by default (For example INPUT chains for a particular Port).

Warning

Try to avoid custom rules whenever possible. For outgoing HTTP(S) connections, please use our Proxy Servers instead (see below)

Allow

{
"base::firewall::rules": {
    "020 accept Puppet to puppetmaster": {
    "dport": "8140",
    "destination": "192.168.0.22",
    "destination6": "2001:db8::22"
    },
    "021 accept HTTP to Package Server": {
    "dport": "80",
    "destination": "192.168.0.21"
    },
    "040 accept incoming HTTP": {
    "chain": "INPUT",
    "dport": "80"
    }
}
}

Deny

You can add custom rules to deny services, too:

{
"base::firewall::rules": {
    "020 deny HTTP because we want to force a secure site with HTTPS only": {
    "chain": "INPUT",
    "dport": "80",
    "action": "reject"
    }
}
}

Hint

HTTP(S) nginx rules are numbered 040 so you must use a lower number for your rule to be processed before the default allow all from nginx-configuration

Warning

Always use “dport”/”sport” instead of “port” to prevent TCP source port firewall attacks

Outgoing proxy

Outgoing requests of all kind are blocked due to safety reason.

Server within the snowflakehosting.ch Zone can use the provided Proxy to Access external Resources:

proxy.snowflakehosting.ch:80

This proxy is already configured trough global Environment Variables for both System and Webserver.

Hint: Make sure to use curl within PHP which will respect those Variables by default

Example usage

TYPO3 8

if ( isset( $_SERVER['http_proxy'] ) ) $GLOBALS['TYPO3_CONF_VARS']['HTTP']['proxy'] = $_SERVER['http_proxy'];

TYPO3

To configure the TYPO3 CMS to take advantage of the proxy, set the following option in your LocalConfiguration.php or AdditionalConfiguration.php:

/*
 * Set http proxy if available
 */

if ($_SERVER['http_proxy'] && strlen($_SERVER['http_proxy']) > 1) {
    $GLOBALS['TYPO3_CONF_VARS']['SYS']['curlProxyServer'] = $_SERVER['http_proxy'];
    $GLOBALS['TYPO3_CONF_VARS']['HTTP']['proxy_host'] = parse_url($_SERVER['http_proxy'], PHP_URL_SCHEME).'://'.parse_url($_SERVER['http_proxy'], PHP_URL_HOST);
    $GLOBALS['TYPO3_CONF_VARS']['HTTP']['proxy_port'] = parse_url($_SERVER['http_proxy'], PHP_URL_PORT);
    $GLOBALS['TYPO3_CONF_VARS']['HTTP']['proxy_user'] = parse_url($_SERVER['http_proxy'], PHP_URL_USER);
    $GLOBALS['TYPO3_CONF_VARS']['HTTP']['proxy_password'] = parse_url($_SERVER['http_proxy'], PHP_URL_PASS);
}

Please also remember to enable the usage of cURL in your conf vars sys section:

'curlUse' => '1'

Hint: don`t forget to use the TYPO3 getURL() and other core functions in your custom build extensions. Otherwise the proxy settings do not work.

Magento

To configure Magneto to use the proxy, set the following options in your downloader/lib/Mage/HTTP/Client/Curl.php file:

protected function makeRequest($method, $uri, $params = array(), $isAuthorizationRequired = false, $https = true)
    {
        $uriModified = $this->getModifiedUri($uri, $https);
        $this->_ch = curl_init();
        $this->curlOption(CURLOPT_PROXY, "http://proxy.snowflakehosting.ch:80");
        $this->curlOption(CURLOPT_URL, $uriModified);
        $this->curlOption(CURLOPT_SSL_VERIFYPEER, false);
        $this->curlOption(CURLOPT_SSL_VERIFYHOST, 2);
        $this->getCurlMethodSettings($method, $params, $isAuthorizationRequired);
       ...
    }

And if you use Zend, set the following options in: lib/Zend/Http/Client/Adapter/Proxy.php

class Zend_Http_Client_Adapter_Proxy extends Zend_Http_Client_Adapter_Socket
{
    /**
     * Parameters array
     *
     * @var array
     */
    protected $config = array(
        'ssltransport'  => 'ssl',
        'sslcert'       => null,
        'sslpassphrase' => null,
        'sslusecontext' => false,
        'proxy_host'    => 'http://proxy.snowflakehosting.ch',
        'proxy_port'    => 80,
        'proxy_user'    => '',
        'proxy_pass'    => '',
        'proxy_auth'    => Zend_Http_Client::AUTH_BASIC,
        'persistent'    => false
    );
...
}

WordPress

To configure WordPress to use the proxy, set the following options in your wp-config.php file:

define('WP_PROXY_HOST', 'proxy.snowflakehosting.ch');
define('WP_PROXY_PORT', '80');
define('WP_PROXY_BYPASS_HOSTS', 'localhost');

Debugging

Logged in as user devop, you can diagnose created rules and logs trough the following means:

Firewall logs in /var/log/messages
show created rules with iptables-list or iptables-rules