879410 - http://runtime-binaries.pvt.build.mozilla.org/tooltool/sha512 not accessible through datacenter VPN

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[[e-mail] (:bhearsum)]

Suspecting apache config changes needed due to srcip being different when coming from Datacenter VPN. I wonder if we can even limit the access to RelEng with this technique through the new vpn?

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

We'll need to add this address to the list of VPN addresses in Puppet, used to generate the Apache configs.

The flow restrictions on the VPN host itself will only allow access to the pvt VIP for appropriate people.

Jabba, what source IP(s) should I use for the DC VPN?

Comment 2

[Justin Dow [:jabba]]

Each person gets a unique IP when connected to the VPN. That range is 10.22.248.0/255.255.252.0 . If using the VPN to tunnel to a public IP (not very common), then it is likely going to source from the scl3 corpdmz NAT address of  63.245.214.169 (nat-corpdmz.scl3.mozilla.com)

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

OK, I made the necessary puppet changes (which was a little tricky, since this is an entire subnet, not just a single IP) to update the ACLs for this new VPN.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Those ACLs don't affect relengweb1

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

Ben, can you get to runtime-binaries from the DC VPN now?

Comment 6

[[e-mail] (:bhearsum)]

http://runtime-binaries.pvt.build.mozilla.org/tooltool/sha512/cf0802c788b26d6f29ada54b986956417b0619a5850c9974ca14e89fc0f2bf5c5c38af7a50cf2d68faa809b1024190eda0154751c4c377657a6802ba50a30cc2 WFM now.