restricted network traffic on zos #98

New Issue

thabeta · 2024-09-19T13:27:13Z

thabeta commented

2024-09-19 13:27:13 +00:00

continuation of #82

restricted outgoing network, only traffic to router is allowed (we get router info over DHCP, auto config)
default whitelisted outgoing web traffic (can be turned off by farmer), which means VM's can only go to whitelisted services (https) and web domains (can be with filter e.g. *.ubuntu.com), this to make sure people cannot use our VM's for e.g. hacking
the whitelists for outgoing traffic come from a github repo which is signed by us, this gets reloaded every hour

continuation of https://git.ourworld.tf/tfgrid/circle_engineering/issues/82 - [ ] restricted outgoing network, only traffic to router is allowed (we get router info over DHCP, auto config) - [ ] default whitelisted outgoing web traffic (can be turned off by farmer), which means VM's can only go to whitelisted services (https) and web domains (can be with filter e.g. *.ubuntu.com), this to make sure people cannot use our VM's for e.g. hacking - [ ] the whitelists for outgoing traffic come from a github repo which is signed by us, this gets reloaded every hour

thabeta commented

2024-09-19 13:28:18 +00:00

as this is requiring a GEP it's moved on its own also still blocked on jan's input

https://github.com/threefoldtech/zos4/pull/6
https://github.com/threefoldtech/zos4/pull/7

as this is requiring a GEP it's moved on its own also still blocked on jan's input https://github.com/threefoldtech/zos4/pull/6 https://github.com/threefoldtech/zos4/pull/7

thabeta added this to the tfgrid_3_15 project 2024-09-19 13:28:23 +00:00

mik-tf commented

2024-09-30 17:02:43 +00:00

Update

We are syncing with comms circle to make sure the info is properly communicated, only when it is ready to be communicated

Comms circle: tfgrid/circle_promotion#291

Status

The GEP can happen after the token-based GEP is passed
@delandtj once it's unblocked on your end, comms circle can write the GEP + ops can create it.

@gosam (comms) @sabrinasadik (ops)

# Update - We are syncing with comms circle to make sure the info is properly communicated, only when it is ready to be communicated # Related Issue - Comms circle: https://git.ourworld.tf/tfgrid/circle_promotion/issues/291 # Status - The GEP can happen after the token-based GEP is passed - @delandtj once it's unblocked on your end, comms circle can write the GEP + ops can create it. @gosam (comms) @sabrinasadik (ops)

mik-tf added the

Story

label 2024-09-30 17:55:56 +00:00

Sign in to join this conversation.