====== Firewall ======
* Blacklist (Host deny)
* Edit /etc/hosts and deny hosts
* List: [[https://loghost.informatik.tu-muenchen.de/hostsdeny/hosts.deny.rbg|RBG-HostDeny-List]]
* Firewall general
* All outgoing traffic allowed
* All incoming traffic denied, required open ports
* Example: ssh port
* Requirement: single point of access >> ssh server without anything else (newest security updates, etc.)
* From central ssh login, login to other server
* VPN (most secure) for entire subnet (131.159.24.0/23)
* All outgoing traffic allowed
* Allow incoming traffic, block everything else
* LDAP user group: users are allowed to login, maintained by [[mailto:rbg-system@in.tum.de?subject=I11 Ldap group|RBG-System]]
* Full access within VPN network
* [[https://wiki.in.tum.de/Informatik/Helpdesk/Vpn|Clients]]
The firewall generally allows all outgoing connections and incoming packets for the previously established connection. All incoming connections are blocked if no exception is made. \\
The firewall supports only TCP connection tracking, UDP is not supported. So for UDP Connections to work usually the whole random port range needs to be allowed for incoming packets -> The program send a packet from a random src port to a service, the service sends back a packet to the random src port, so an exception needs to be present that allows this packet for the connection to be successful. As there is often no control of the src port all random port needs to be opened: 1024-65535
===== Firewall 2019_01_18 =====
Does not exist - internal server management network - completely seperated
no ip access-list extended acl4-il11-out
ip access-list extended acl4-il11-out
permit ip host 131.159.25.254 any
permit ip host 131.159.25.253 any
permit ip host 131.159.25.252 any
deny ip 131.159.24.0 0.0.1.255 any
remark *** rbg server
permit ip 131.159.254.0 0.0.1.255 any
remark VPN Zugang il11
permit ip 172.24.146.0 0.0.0.255 any
remark il11_3
permit ip 10.200.64.0 0.0.63.255 any
remark *** ping usw.
permit icmp any any
remark established
permit tcp any any established
remark rbg administration
permit tcp 131.159.42.0 0.0.1.255 any eq 22
permit tcp 131.159.42.0 0.0.1.255 any eq 3389
remark macschlichter14 2016022210004457
permit tcp any host 131.159.24.169 eq 22
permit tcp any host 131.159.24.169 eq 80
permit tcp any host 131.159.24.169 eq 443
remark macschlichter11 2016022210004457 2017050810006537 2018052310008835
permit tcp any host 131.159.24.63 eq 22
remark cm05 2016051210002589
permit udp any host 131.159.24.101 eq 500
permit udp any host 131.159.24.101 eq 4500
permit ip host 129.187.102.13 host 131.159.24.101
remark vmschlichter21 2016040410005754
permit tcp any host 131.159.24.76 eq 22
permit tcp any host 131.159.24.76 eq 8000
remark vmschlichter28 2016040410005754
permit tcp any host 131.159.24.82 eq 21
permit tcp any host 131.159.24.82 eq 22
permit tcp any host 131.159.24.82 eq 80
remark ideaclouds1 2016032410006628 2018042610006262
permit tcp any host 131.159.24.245 eq 80
permit tcp any host 131.159.24.245 eq 443
permit tcp any host 131.159.24.245 eq 5060
permit tcp any host 131.159.24.245 eq 8080
remark vmott4 2016042710007487
permit tcp any host 131.159.25.6 eq 443
remark vmott5 2016051210001106 2016051210001106
permit tcp any host 131.159.24.2 eq 22
permit tcp any host 131.159.24.2 eq 80
permit tcp any host 131.159.24.2 eq 8080
permit tcp any host 131.159.24.2 eq 3306
remark vmschlichter24 2016052410006366 2016053110006405
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.239 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.239 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.239 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.239 eq 22
permit tcp any host 131.159.24.239 eq 80
permit tcp any host 131.159.24.239 eq 443
remark devimg01 2016080310008451
permit ip host 172.24.15.23 host 131.159.24.137
remark testbed02 2016090510005912 2016091610006491 2016092810005236
permit tcp any host 131.159.24.150 eq 8080
permit tcp 172.24.21.192 0.0.0.31 host 131.159.24.150 eq 8086
permit tcp 172.24.21.192 0.0.0.31 host 131.159.24.150 eq 27017
remark vmott11 2016112510000983 2016121210002084 2016122310002545 2017040610001065 2018031610006514
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.38 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.38 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.38 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.38 eq 22
permit tcp any host 131.159.24.38 eq 80
permit tcp any host 131.159.24.38 eq 443
permit tcp any host 131.159.24.38 eq 8883
permit tcp any host 131.159.24.38 eq 3306
permit tcp 131.159.192.0 0.0.31.255 host 131.159.24.38 eq 11234
permit tcp 131.159.224.0 0.0.1.255 host 131.159.24.38 eq 11234
permit tcp 172.24.21.192 0.0.0.31 host 131.159.24.38 eq 12356
remark vmott12 2016102110002472 2016110210005888 2017030210005918 2017122010005028
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.41 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.41 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.41 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.41 eq 22
permit tcp any host 131.159.24.41 eq 80
permit tcp any host 131.159.24.41 eq 443
permit tcp any host 131.159.24.41 eq 8080
remark vmott14 2016121310003214
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.53 eq 22
permit tcp any host 131.159.24.53 eq 80
permit tcp any host 131.159.24.53 eq 443
remark vmott16 2018071710009646 2018082110006586 2018082410001316
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.164 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.164 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.164 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.164 eq 22
permit udp any host 131.159.24.164 range 1024 65535
permit udp any host 131.159.24.164 eq 443
permit tcp any host 131.159.24.164 eq 53
permit udp any host 131.159.24.164 eq 53
remark vmott17 2018072610003411 2018073010001762
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.174 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.174 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.174 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.174 eq 22
permit udp any host 131.159.24.174 range 3389 3390
remark vmott20 2018103110002021 2018110210002805
permit tcp any host 131.159.24.56 eq 80
permit tcp any host 131.159.24.56 eq 443
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.56 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.56 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.56 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.56 eq 22
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.56 eq 3306
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.56 eq 3306
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.56 eq 3306
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.56 eq 3306
remark cm03 2017022710006962
permit tcp any host 131.159.24.17 eq 31313
remark cm24 2017050910007927
permit tcp any host 131.159.24.60 eq 22
permit tcp any host 131.159.24.60 eq 80
remark cm29 2017092910000611 2017100510006318
permit ip any host 131.159.24.105
remark one02.cm 201707121000331
permit tcp any host 131.159.24.86 eq 80
permit tcp any host 131.159.24.86 eq 443
remark one03.cm 201707121000331
permit tcp any host 131.159.24.84 eq 80
permit tcp any host 131.159.24.84 eq 443
remark one05.cm 2017100510002901
permit tcp any host 131.159.24.113 eq 80
permit tcp any host 131.159.24.113 eq 443
permit tcp any host 131.159.24.113 eq 2222
permit udp any host 131.159.24.113 range 1024 65535
remark one09.cm 2017120410002945
permit tcp any host 131.159.24.127 eq 80
permit tcp any host 131.159.24.127 eq 443
remark test03.cm 2017100510006318
permit ip any host 131.159.24.114
remark one10.cm 2018021510008043 2018022610006453
permit tcp any host 131.159.24.138 eq 80
permit tcp any host 131.159.24.138 eq 443
permit tcp any host 131.159.24.138 eq 3000
permit tcp any host 131.159.24.138 eq 8000
permit tcp any host 131.159.24.138 eq 8080
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.138 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.138 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.138 eq 22
remark one11.cm 2018022310004693 2018071110004161
permit tcp 131.159.0.0 0.0.225.255 host 131.159.24.139 eq 22
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.139 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.139 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.139 eq 22
permit tcp 131.159.0.0 0.0.225.255 host 131.159.24.139 eq 80
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.139 eq 80
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.139 eq 80
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.139 eq 80
permit tcp 131.159.0.0 0.0.225.255 host 131.159.24.139 eq 443
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.139 eq 443
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.139 eq 443
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.139 eq 443
permit tcp 131.159.0.0 0.0.225.255 host 131.159.24.139 eq 3000
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.139 eq 3000
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.139 eq 3000
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.139 eq 3000
permit tcp 131.159.0.0 0.0.225.255 host 131.159.24.139 eq 8000
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.139 eq 8000
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.139 eq 8000
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.139 eq 8000
permit tcp 131.159.0.0 0.0.225.255 host 131.159.24.139 eq 8080
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.139 eq 8080
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.139 eq 8080
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.139 eq 8080
remark one13.cm 2018041810001497
permit tcp any host 131.159.24.140 eq 9873
remark one15.cm 2018042710010531
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.144 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.144 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.144 eq 22
permit tcp any host 131.159.24.144 eq 80
permit tcp any host 131.159.24.144 eq 443
permit tcp any host 131.159.24.144 eq 3306
permit tcp any host 131.159.24.144 eq 8883
remark net03-cm 2018031610006103
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.166 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.166 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.166 eq 22
remark emu02 2018032310004539
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.21 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.21 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.21 eq 22
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.21 eq 8082
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.21 eq 8082
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.21 eq 8082
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.21 eq 8181
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.21 eq 8181
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.21 eq 8181
remark atschlichter29 2018040510006195 2018041910006285
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.108 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.108 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.108 eq 22
permit tcp any host 131.159.24.108 eq 3036
permit udp any host 131.159.24.108 eq 3036
remark one16 2018061410011122
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.149 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.149 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.149 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.149 eq 22
permit udp any host 131.159.24.149 range 1024 65535
remark one19 2018070910008439
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.154 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.154 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.154 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.154 eq 22
permit udp any host 131.159.24.154 eq 443
permit udp any host 131.159.24.154 range 3389 3391
remark one20 2018070910008948
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.156 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.156 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.156 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.156 eq 22
remark one21 2018070910010971
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.157 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.157 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.157 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.157 eq 22
remark one22 201807181000675
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.165 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.165 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.165 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.165 eq 22
permit tcp any host 131.159.24.165 eq 3389
remark one23 2018111910003345 2018112010013331
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.193 eq 22
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.193 eq 22
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.193 eq 22
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.193 eq 22
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.193 eq 80
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.193 eq 80
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.193 eq 80
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.193 eq 80
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.193 eq 443
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.193 eq 443
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.193 eq 443
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.193 eq 443
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.193 eq 8080
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.193 eq 8080
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.193 eq 8080
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.193 eq 8080
remark one24 2018092410011152
permit tcp any host 131.159.24.48 eq 80
permit tcp any host 131.159.24.48 eq 443
remark cm43 2018080110008826
permit udp any host 131.159.24.179 range 3389 3391
remark social1 2018082110006746 2018111910002828
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.12
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.12
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.12
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.12
remark social2 2018020910006502 2018082110006746 2018111910002828
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.134
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.134
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.134
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.134
remark social3 2016022210004457 2018082110006746 2018111910002828
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.238
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.238
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.238
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.238
remark social4 2018080610007631 2018082110006746 2018111910002828
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.13
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.13
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.13
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.13
remark social5 2016022210004457 2018082110006746 2018111910002828
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.171
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.171
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.171
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.171
remark social6 2018091710010998 2018111910002828
permit tcp 129.187.0.0 0.0.255.255 host 131.159.24.184
permit tcp 131.159.0.0 0.0.255.255 host 131.159.24.184
permit tcp 10.152.42.0 0.0.1.255 host 131.159.24.184
permit tcp 10.152.126.0 0.0.1.255 host 131.159.24.184
deny ip any any
exit
no ip access-list extended acl4-il11_3-out
ip access-list extended acl4-il11_3-out
permit ip host 10.200.127.254 any
permit ip host 10.200.127.253 any
permit ip host 10.200.127.252 any
remark anti spoofing
deny ip 10.200.112.0 0.0.15.255 any
remark rbg server
permit ip 131.159.254.0 0.0.1.255 any
remark lehrstuhl netz
permit ip 131.159.24.0 0.0.1.255 any
remark VPN Zugang il11
permit ip 172.24.146.0 0.0.0.255 any
remark Zugang il11_6
permit ip 10.200.96.0 0.0.15.255 any
remark MWN
permit ip any 172.24.24.0 0.0.1.255
remark established
permit tcp any any established
remark vmott22 Zugang RBG 2019011710009021
permit tcp 131.159.42.0 0.0.1.255 host 10.200.120.9 eq 22
deny ip any any
exit
no ip access-list extended acl4-il11-4-out
ip access-list extended acl4-il11-4-out
permit ip host 172.24.21.222 any
permit ip host 172.24.21.221 any
permit ip host 172.24.21.220 any
deny ip 172.24.21.192 0.0.0.31 any
remark *** rbg server
permit ip 131.159.254.0 0.0.1.255 any
remark VPN Zugang il11
permit ip 172.24.146.0 0.0.0.255 any
remark established
permit tcp any any established
remark cm04 2016081710008318
permit tcp host 131.159.24.79 any eq 22
remark cm07 2016081710008318
permit tcp host 131.159.24.130 any eq 22
remark testbed2 2016092110004722 2017020810004679
permit tcp host 131.159.24.150 any eq 22
permit tcp host 131.159.24.150 any eq 8080
permit tcp host 131.159.24.150 any eq 8086
deny ip any any
exit
no ip access-list extended acl4-il11_5-out
ip access-list extended acl4-il11_5-out
permit ip host 172.24.25.254 any
remark anti spoofing
deny ip 172.24.24.0 0.0.1.255 any
remark rbg server
permit ip 131.159.254.0 0.0.1.255 any
remark lehrstuhl netz
permit ip 131.159.24.0 0.0.1.255 any
remark VPN Zugang il11
permit ip 172.24.146.0 0.0.0.255 any
remark LRZ VPN 2017121310013176
permit ip 129.187.0.0 0.0.255.255 any
permit ip 10.152.42.0 0.0.1.255 any
permit ip 10.152.126.0 0.0.1.255 any
remark MWN
permit ip any 172.24.24.0 0.0.1.255
permit tcp any any established
deny ip any any
exit
no ip access-list extended acl4-il11_3-out
ip access-list extended acl4-il11_3-out
permit ip host 10.200.111.254 any
permit ip host 10.200.111.253 any
permit ip host 10.200.111.252 any
remark anti spoofing
deny ip 10.200.96.0 0.0.15.255 any
remark rbg server
permit ip 131.159.254.0 0.0.1.255 any
remark lehrstuhl netz
permit ip 131.159.24.0 0.0.1.255 any
remark VPN Zugang il11
permit ip 172.24.146.0 0.0.0.255 any
remark Zugang il11_6
permit ip 10.200.112.0 0.0.15.255 any
remark MWN
permit ip any 172.24.24.0 0.0.1.255
permit tcp any any established
deny ip any any
exit
|===== Firewall Exceptions =====
^Hostname ^IP ^Ports ^User ^Notes |
|vmschlichter21 |131.159.24.76 |8000, 22 |woerndl |- |
|vmschlichter28 |131.159.24.82 |80 |woerndl |- |
|social1 | 131.159.24.12 | * - MWN/LRZ VPN |gerhard hagerer | social server |
|social2 | 131.159.24.134 | * - MWN/LRZ VPN |gerhard hagerer | social server |
|social3 | 131.159.24.238 | * - MWN/LRZ VPN |gerhard hagerer | social server |
|social4 | 131.159.24.13 | * - MWN/LRZ VPN |gerhard hagerer | social server |
|social5 | 131.159.24.171 | * - MWN/LRZ VPN |gerhard hagerer | social server |
|social6 | 131.159.24.184 | * - MWN/LRZ VPN |gerhard hagerer | social server |
|vmott4|131.159.25.6|443|paulth|Https permission for calendar synchronization|
|vmott5|131.159.24.2|80,22|woerndl|SSH and HTTP persmission|
|cm05|131.159.24.101|500,4500, every from 129.187.102.13(zv firewall-cluster)|christinne lissner|VPN access for SAP application|
|vmschlichter24|131.159.24.239|22 from LRZ VPN subnets|georg groh|SSH Access for student Safey Halim from LRZ VPN|
|vmschlichter24|131.159.24.239|80, 443| georg groh| Webserver for student project|
|vmschlichter27|131.159.24.81|80,443|hanna schaefer|Webserver Projekt|
|vmschlichter29|131.159.24.40|80,443|hanna schaefer|Webserver Projekt Test VM|
|devimg01|131.159.24.137|all-172.24.15.23|leonardo tonetto|SSH und NFS zwischen devimg01 und ComputeVM23|
|testbed02|131.159.24.150|il11_edison - 8086 il11_edison, il11_edison - 27017|vittorio cozzolino|Edison to Backend database (Influx DB + Mono DB)|
|testbed02|131.159.24.150|port 8080|vittorio cozzolin|Mobile Phone access NodeJS - local Firewall on testbed02 to allow only mac of mobile phone|
|il11_edison|172....(edison net)|testbed02 - 8086 (tcp)|vittorio cozzolin|Get Data directly from Edisons|
|il11_edison|172....(edison net)|testbed02 - 8080 (tcp)|vittorio cozzolin|NodeJS Endpoint - Edison Board Camera|
|il11_edison|172....(edison net)|testbed02 - 22 (tcp)|vittorio cozzolin|SSH Access|
|il11_edison|172....(edison net)|vmott11 - 3306 (tcp)|michael haus|MySQL server|
|vmott11|131.159.24.38|80, 443, 8883 (Mqtt), 3306 (MySQL) - All; 22 - MWN|michael haus|Sensor data collection|
|vmott12|131.159.24.41|LRZ VPN - 22 + all : anywhere - 443, 8080, 80|daniel herzog|Citytrip Planer Masterstudent|
|vmott14|131.159.24.53|LRZ VPN - 22|sebastian schams|Social Computing Summer Experiment|
|vmott14|131.159.24.53|anywhere - 80 + 443|sebastian schams|Social Computing Summer Experiment|
|cm03|131.159.24.17|anywhere - 31313|teemu kaerkkaeinen|test port for work laptop (cm03)|
|one04 (cherry.cm.in.tum.de)|131.159.24.60|anywhere - 80, 22|Vaibhav Bajpai|Master student data analysis|
|one02 (phi.cm.in.tum.de)|131.159.24.86|anywhere - 80, 443|Thomas Paul|Webserver Edge Workshop|
|one03 (grapes.cm.in.tum.de)|131.159.24.84|anywhere - 80, 443|Vaibhav Bajpai|Probe VM Opennebula, collect probe data|
|one05 (pandora.cm.in.tum.de)|131.159.24.113|anywhere- 80,443,2222,9000,9080 TCP + 1024-65535 UDP|Jörg Ott|Quic Test Server 10/17|
|one08 (monkey.cm.in.tum.de) |131.159.24.63 |22|leonardo tonetto |ONE VM Monkey Leonardo Tonetto - 04/17 |
|one09 (mango/hotcrp.cm.in.tum.de)|131.159.24.127|anywhere - 443,80|Vaibhav Bajpai|ONE VM Mango Hotcrp Host - 12/17|
|one10 (canberra)|131.159.24.138|LRZ VPN/MWN - 22,443,80,8080,3000,8000|Daniel Herzog|ONE Daniel Herzog Master student - 03/19|
|emu02|131.159.24.21|LRZ VPN/MWN - 22,8082,8181|Thomas Paul|Marcel Lotze + Chaitwanya student Dell Switch Controler 03/18|
|one12 (mira)|131.159.24.108|LRZ VPN/MWN - 22, anywhere - 3036|Viet Doan|ONE mira Viet Doan MT student thanumai 11/18|
|one13 (externalds)|131.159.24.140|anywhere - 9873 (ssh port!)|Linus Dietz|Build Server uses SFTP 04/18|
|ideacloud1|131.159.24.245|anywhere - 80,443,5060,8080|Michele Broco|Ideacloud Laptop Michele 04/18|
|one15 (proton)|131.159.24.144|anywhere - 80,443,8883,3306; mwn - 22|Michael Haus|Social Computing Task - Data Collection VM 04/18|
|one16 (emilia)|131.159.24.149| anywhere - udp 1024-65536; mwn - 22|Vaibhav Bajpai|Quic Test Server Master Thesis Bernhard Jäger 06/18|
|one20 (veronika)|131.159.24.156|lrz vpn/mwn - tcp 22|Vaibhav Bajpaiv|Vaibhav student Jeslin John 07/18|
|one19 (katarina)|131.159.24.154|lrz vpn/mwn - tcp 22, all - udp 443,3389-3391|Vaibhav Bajpai|Vaibhav student Quic Measurements Sergey Podanev 07/18|
|one21 (banana)|131.159.24.157|lrz vpn/mwn - tcp 22|Vaibhav Bajpaiv| Vaibhav student Justus Fries 07/18|
|vmott16|131.159.24.164|lrz vpn/mwn - tcp 22, all - udp 443,3389-3390, all - udp+tcp 53 (external DNS), all - udp 1024-65535|Vaibhav Bajpaic|Vaibhav student Quic measurement, external DNS queries VM Sergey Podanev + Jeslin John 07/18|
|one22 (albany)|131.159.24.165|lrzvpn/mwn - tcp 22, all - tcp 3389|Viet Doan|Viet Bsc student Mobile phone data collection sftp Markus Oberprieler 07/18|
|vmott17|131.159.24.174|lrzvpn/mwn - tcp 22, any - udp 3389-3390|Vaibhav Bajpai|Vaibhav Student Quic Procotol measurements Bernhard Jäger 07/18|
|cm43|131.159.24.179|any - udp 3389-3391|Vaibhav Bajpai|Vaibhav student QUIC Sergey Podanev 08/18|
|one24 (meter.cm.in.tum.de)|131.159.24.48|any - tcp 80,443,4556,1234,7895|Thomas Paul|Arthur Meter Digitalization Backend Server 09/18|
|vmott23|131.159.24.40|any-tcp 80+443, mwn-tcp 22+3306|Wolfgang Wörndl|MT Haimerl Mysql DB und Webserver 03/19|
|one23 (kiwi.cm.in.tum.de)|131.159.24.193|mwn - tcp 22,80,8080,443|Vaibhav Bajpai|MT Florian Sprang dashboard cdn 11/18|
|vmott21|131.159.24.7|any - tcp 80 + 443|Simon Zelenski|Dokuwiki VM Service IP|
|testbed01|131.159.24.142|any - tcp 8877|Teemu Kaerkkaeinen| Testbed01 Experiments|
|one01|131.159.24.42| any - tcp 80 + 443|Vaibhav Bajpai|ONE plum Data Collection VM|
|one06|131.159.24.47| MWN - 22 |Faulhaben Nils|ONE cathy Thesis VM|
|one10|131.159.24.31| MWN - UDP 47810-47812 |Ayguen Baltaci|ONE anelia Research VM|
|one17 (stella)|131.159.24.89| MWN - TCP+UDP 3000, UDP 8000, TCP 22 |Simon Kostin (Daniel Herzog)|ONE stella Student Thesis VM|
|sensornet.cm.in.tum.de|131.159.24.90|All - 9090, 9091 TCP|Teemu Kaerkkaeinen Service IP - IOT Sensornet VM deneb|
|grobid.cm.in.tum.de|131.159.24.112| 8070 TCP | Linus Dietz | grobid serves http on port 8070 |
|mobility-dashboard| 131.159.24.114| TCP 22,8050 open zo MWN, TCP 80, 443 open to Internet| Lukas Vorwerk (Linus Dietz) | Student Thesis VM |
|one36.cm.in.tum.de|131.159.24.120| TCP 80, 443 worldwide|Michael Haus|data publishing VM|
|awx.cm.in.tum.de|131.159.24.178|TCP 80, 443 MWN|Thomas Paul|open awx for MWN hosts|
|trace.cm.in.tum.de (one58)|131.159.24.160|TCP 22 MWN|Viet Doan|traceroute measurements with IPv6|
===== Firewall Exceptions for Chair <-> RBG Ceph =====
one38 (one-db)
one45 (one-vault)
one48 (one-awx)
devimg01 - 131.159.24.137
testbed01 - 131.159.24.142
testbed02 - 131.159.24.150
sim01 - 131.159.24.15
net01 - 131.159.24.163
net02 - 131.159.24.151
net03 - 131.159.24.166
emu01 - 131.159.24.18
emu02 - 131.159.24.21
emu03 - 131.159.24.20
emu06 - 131.159.24.35
host:f:awx.cm.in.tum.de 131.159.24.178
host:f:vault.cm.in.tum.de 131.159.24.29
host:f:orders.cm.in.tum.de 131.159.24.34
host:f:hostview.cm.in.tum.de 131.159.24.91
host:f:db.cm.in.tum.de 131.159.24.52
host:f:awx.cm.in.tum.de 131.159.24.178
host:f:icinga.cm.in.tum.de 131.159.24.117
host:f:one01.cm.in.tum.de 131.159.24.42
host:f:one02.cm.in.tum.de 131.159.24.86
host:f:one03.cm.in.tum.de 131.159.24.84
host:f:one04.cm.in.tum.de 131.159.24.60
host:f:one05.cm.in.tum.de 131.159.24.113
host:f:one06.cm.in.tum.de 131.159.24.47
host:f:one07.cm.in.tum.de 131.159.24.10
host:f:one08.cm.in.tum.de 131.159.24.63
host:f:one09.cm.in.tum.de 131.159.24.127
host:f:one10.cm.in.tum.de 131.159.24.31
host:f:one11.cm.in.tum.de 131.159.24.139
host:f:one12.cm.in.tum.de 131.159.24.108
host:f:one13.cm.in.tum.de 131.159.24.140
host:f:one14.cm.in.tum.de 131.159.24.83
host:f:one15.cm.in.tum.de 131.159.24.144
host:f:one16.cm.in.tum.de 131.159.24.149
host:f:one17.cm.in.tum.de 131.159.24.89
host:f:one18.cm.in.tum.de 131.159.24.153
host:f:one19.cm.in.tum.de 131.159.24.154
host:f:one20.cm.in.tum.de 131.159.24.156
host:f:one21.cm.in.tum.de 131.159.24.157
host:f:one22.cm.in.tum.de 131.159.24.165
host:f:one23.cm.in.tum.de 131.159.24.193
host:f:one24.cm.in.tum.de 131.159.24.48
host:f:one28.cm.in.tum.de 131.159.24.114
host:f:one31.cm.in.tum.de 131.159.24.112
host:f:one34.cm.in.tum.de 131.159.24.115
host:f:one36.cm.in.tum.de 131.159.24.120
host:intum:vmott10 131.159.24.36
host:intum:vmott11 131.159.24.38
host:intum:vmott12 131.159.24.41
host:intum:vmott14 131.159.24.53
host:intum:vmott16 131.159.24.164
host:intum:vmott17 131.159.24.174
host:intum:vmott18 131.159.24.50
host:intum:vmott19 131.159.24.187
host:intum:vmott2 131.159.24.136
host:intum:vmott20 131.159.24.56
host:intum:vmott21 131.159.24.5
host:intum:vmott23 131.159.24.40
host:intum:vmott24 131.159.24.45
host:intum:vmott25 131.159.24.110
host:intum:vmott3 131.159.24.141
host:intum:vmott4 131.159.25.6
host:intum:vmott5 131.159.24.2
host:intum:vmott8 131.159.24.14
host:intum:vmschlichter21 131.159.24.76
host:intum:vmschlichter22 131.159.24.30
host:intum:vmschlichter24 131.159.24.239
host:intum:vmschlichter28 131.159.24.82
===== Firewall Exceptions IPv6 =====
^Hostname ^IP ^Ports ^User ^Notes |
|vmott7|2001:4ca0:2003:240::9|lrz vpn/mwn - tcp 22, all - udp 443,3389-339|Vaibhav Bajpaic|Vaibhav student Quic measurement faster network VM Sergey Podanev 07/18|
|one19 (katarina)|2001:4ca0:2003:240::154|lrz vpn/mwn - tcp 22, all - udp 443,3389-3391|Vaibhav Bajpai|Vaibhav student Quic Measurements Sergey Podanev 07/18|
|vmott16|2001:4ca0:2003:240::164|lrz vpn/mwn - tcp 22, all - udp 443,3389-3391, all - udp+tcp 53 (external DNS), all - udp 1024-65535|Vaibhav Bajpaic|Vaibhav student Quic measurement, external DNS queries VM Sergey Podanev + Jeslin John 07/18|
|vmott17|2001:4ca0:2003:240::174|any - udp 3389-3390|Vaibhav Bajpai|Vaibhav Student Quic Procotol measurements Bernhard Jäger 07/18|
|one01|2001:4ca0:2003:240::42| any - tcp 80 + 443|Vaibhav Bajpai|ONE plum Data Collection VM|
|sensornet.cm.in.tum.de|2001:4ca0:2003:240::90|All - 9090, 9091 TCP|Teemu Kaerkkaeinen Service IP - IOT Sensornet VM deneb|
|one36.cm.in.tum.de|2a09:80c0:24::120|TCP 80, 443 worldwide|Michael Haus|data publishing VM|
===== Firewall Network =====
**il11**\\
remark VPN Zugang il11
permit ip 172.24.146.0 0.0.0.255 any
remark LRZ VPN 2017121310013176
permit ip 129.187.0.0 0.0.255.255 any
permit ip 10.152.42.0 0.0.1.255 any
permit ip 10.152.126.0 0.0.1.255 any
**il11_5 (MWN / ONE)**\\
# Zugriff aus dem eduroam Netz
remark Doktoranden der Sensorknoten 2020021810005143
permit tcp 131.159.192.0 0.0.31.255 any eq 22
permit tcp 131.159.192.0 0.0.31.255 any eq 80
permit tcp 131.159.192.0 0.0.31.255 any eq 443
permit tcp 131.159.192.0 0.0.31.255 any eq 1883
permit tcp 131.159.192.0 0.0.31.255 any eq 8080
permit tcp 131.159.192.0 0.0.31.255 any eq 8883
remark Doktoranden der Sensorknoten 2020021810005143
permit tcp 2a09:80c0:192::/64 any eq 22
permit tcp 2a09:80c0:192::/64 any eq 80
permit tcp 2a09:80c0:192::/64 any eq 443
permit tcp 2a09:80c0:192::/64 any eq 1883
permit tcp 2a09:80c0:192::/64 any eq 8080
permit tcp 2a09:80c0:192::/64 any eq 8883
===== VPN =====
People with VPN access to the chair network can be seen on the RBG webapp under the LDAP group vpnil11 -[[https://rbgwebapp.in.tum.de/struktur/eintrag/vpn:vpnil11]]. Check [[services:network#chair_vpn|this]] wiki page to request access as an employee. As an aministrators check [[infrastructure:network#vpn|this]] page.