671176 - Allow IRC servers to connect to each other over the Internet

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps, task)

Description

[Dave Miller [:justdave]]

Right now, the IRC servers all link to each other over the VPN.  We had an extended VPN outage tonight, and when I tried to fail the irc links over their external IPs, we discovered the ports weren't open to be able to do so.  The inter-server links all operate on port 6665.  Just for sanity, we should probably restrict these IPs to being able to connect to each other, so the source IPs should match, too.

sand.mozilla.org has address 63.245.208.159
concrete.mozilla.org has address 63.245.216.214
gravel.mozilla.org has address 63.245.212.23

Those three IPs should all be able to connect to each other on port 6665 (which probably means opening that port from the other two IP addresses on each of the three colos).

Thanks!

Comment 1

[Aaron]

The end goal for the vpn is to have it capable of failing between the Internet and the P2P link.  We shouldn't experience any long vpn outages once we get to that state.  

Will that be sufficient, or do you still want to remove the dependency on the vpn completely?

Comment 2

[Ravi Pina [:ravi]]

all paths from PHX to SJC will traverse the same SRX pair.  That said the VPN will always be up and act as either a primary or backup.

Comment 3

[Dave Miller [:justdave]]

(In reply to comment #1)
> Will that be sufficient, or do you still want to remove the dependency on
> the vpn completely?

Yeah, that's probably fine.  Was just looking for an alternate path, but if it auto-fails to a backup it ought to be fine.

Comment 4

[Dave Miller [:justdave]]

Sounds like we have another known-in-advance outage for this network link planned though...  can we get this route opened for now to help avoid downtime during tonight's outage, and then we can nuke it once the above-mentioned failover is actually in place and working?

Comment 5

[Derek Moore [:dmoore]]

These rules are now in place, as requested.

As a side effect, concrete now has full static (inbound/outbound) NAT.

gravel had no existing filtering on port 6665. It will require a simple iptables change to correct this.

Comment 6

[Dave Miller [:justdave]]

gravel isn't actually online at the moment anyway.  Hope to get that up soon.