--- title: How To Secure Your DC/OS Packet Cluster with IP Whitelisting using ipset description: Recently I wanted to run DC/OS on Packet, the bare metal cloud. However, the Terraform scripts do not setup any firewall rules. This leaves the cluster exposed to internet traffic. To fix this I setup an IP whitelist to block undesirable external traffic. --- [Cloud Native Blog - Container Solutions ](https://blog.container-solutions.com) # [How To Secure Your DC/OS Packet Cluster with IP Whitelisting using ipset](https://blog.container-solutions.com/how-to-secure-dcos-packet-cluster-ip-whitelisting-ipset) Written by [Frank Scholten](https://blog.container-solutions.com/author/frank-scholten) | Apr 28, 2017 10:23:47 AM Recently I wanted to run DC/OS on Packet, the bare metal cloud. However, the Terraform scripts do not setup any firewall rules. This leaves the cluster exposed to internet traffic. To fix this  I setup an IP whitelist to block undesirable external traffic. In this blog I will show you how this works using the `ipset` and `iptables` commands. ### **DC/OS on Packet** First let's create a small development DC/OS cluster. We will deploy this cluster on [Packet](http://www.packet.net), the bare metal cloud provider. In many cases [Packet is cheaper with better performance than AWS](https://blog.tiingo.com/switched-away-aws-packet-net-benchmarking-networking-disk-processing-speeds) and it offers bare-metal instances and a layer-3 network so it is an interesting option for running DC/OS on. To get started clone the repository with [Terraform scripts for DC/OS on Packet](https://github.com/ContainerSolutions/packet-terraform) and then follow the [DC/OS Terraform documentation](https://dcos.io/docs/1.7/administration/installing/cloud/packet). I recommend creating a small cluster with a single master, a bootstrap node and a at least one agent. ### **IP whitelisting** The easiest way to protect the cluster is via an IP whitelist. This whitelist will be applied to all nodes in the cluster. This way we can create firewall rules that only allow traffic from your IP and the IPs of nodes in the cluster while logging and dropping other traffic from outside else. This setup should be good enough for a simple development cluster. On all instances create a whitelist that contains your laptop, workstation or company IP and the IPs of each node in the DC/OS cluster. ### **What is ipset?** You are probably familiar with iptables but may not know ipset. ipset is like iptables part of [netfilter](https://www.netfilter.org) subsystem in Linux and it support creating lists of IPs or networks also supports IPv6. For more information check the [ipset website](http://ipset.netfilter.org). Before you create the IP whitelist SSH into your cluster nodes using the following command. Note the private key for Packet and the core user because the cluster runs CoreOS. ``` ssh -i packet-key core@$IP ``` Now let's create an IP whitelist: - Create an IP whitelist with `ipset create whitelist hash:ip` - Use `ipset add whitelist $IP` to add an IP - Add IPs from the output of `terraform output` - Add Google's DNS servers `8.8.8.8` and `8.8.4.4` - Add the loopback address `127.0.0.1` - Add the IPs from interfaces created by [Spartan](https://github.com/dcos/spartan), Mesospheres DNS dispatcher `198.51.100.1`, `198.51.100.2`, `198.51.100.3` ### **Setting up the firewall** Let's activate the whitelist with some remaining firewall rules. First, we will allow established and related connections. If you don't do this DC/OS won't be able to connect to the universe package repository. Second, let's log packets that are not in the whitelist and third, let's drop them. See the commands below. ``` ipset create whitelist hash:ip ipset list whitelist (out) Name: whitelist (out) Type: hash:ip (out) Revision: 4 (out) Header: family inet hashsize 1024 maxelem 65536 (out) Size in memory: 120 (out) References: 0 (out) Members: ipset add whitelist $YOUR_IP_HERE ipset add whitelist $MASTER_IP ipset add whitelist $AGENT1_IP ipset add whitelist $AGENT2_IP ipset add whitelist $AGENT3_IP ipset add whitelist 127.0.0.1 ipset add whitelist 198.51.100.1 ipset add whitelist 198.51.100.2 ipset add whitelist 198.51.100.3 ipset add whitelist 8.8.8.8 ipset add whitelist 8.8.4.4 iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m set ! --match-set whitelist src -j LOG iptables -A INPUT -m set ! --match-set whitelist src -j DROP ``` Great! The cluster is ready and shielded from external internet traffic.   **DC/OS on Packet - The Bare Metal Cloud**   ### **Takeaways** We described a simple way to manually setup a firewall for a small development DC/OS cluster on Packet. An obvious improvement would be to make these rules persistent and to automate this process by using tools like Ansible or [Nix](http://container-solutions.com/step-towards-future-configuration-infrastructure-management-nix) or to install firewall management software. ### **Links** - [DC/OS Website](https://www.dcos.io) - [DC/OS Documentation](https://dcos.io/docs) - [Packet website](https://www.packet.net) - [ipset website](http://ipset.netfilter.org) - [Linux Journal article on ipset by Henry van Styn](http://www.linuxjournal.com/content/advanced-firewall-configurations-ipset) ([@vanstyn](https://twitter.com/vanstyn)) ### **Keep in touch!** Thanks for reading! Questions? Comment on the blog or talk us at [@ContainerSoluti](https://twitter.com/Containersoluti) or to myself at [@Frank_Scholten](https://twitter.com/Frank_Scholten). ### ***P.S. Like to learn more about Cloud Native?*** Container Solutions offers *Cloud Native Training Courses *such as [Kubernetes 101](http://www.container-solutions-trainings.com/training/kubernetes101), [Continuous Delivery with Docker](http://www.container-solutions-trainings.com/training/continuous-delivery-with-docker), [Container & Microservice Security](http://www.container-solutions-trainings.com/training/microservice-security), [Monitoring with Prometheus](http://www.container-solutions-trainings.com/training/monitoring-with-prometheus) and our 2-day [From Zero to Hero Workshop](http://www.container-solutions-trainings.com/training/from-zero-to-hero). We also offer a month-long *Cloud Native Bootcamp. *The bootcamp will cover Linux Basics, Agile and TDD, containers, orchestrators and Design Thinking courses. The final week of the bootcamp consists of a Hackathon where you will build a Cloud Native application with your team. To learn more check out our [training courses website](http://www.container-solutions-trainings.com). [View full post](https://blog.container-solutions.com/how-to-secure-dcos-packet-cluster-ip-whitelisting-ipset) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Frank Scholten" }, "dateModified" : "2019-07-09T13:58:33.027Z", "datePublished" : "2017-04-28T10:23:47Z", "headline" : "How To Secure Your DC/OS Packet Cluster with IP Whitelisting using ipset", "image" : { "@type" : "ImageObject", "height" : 612, "url" : "http://cdn2.hubspot.net/hubfs/2668666/All-InOne-2016/Image/bg-img.jpg", "width" : 1600 }, "mainEntityOfPage" : "https://blog.container-solutions.com/how-to-secure-dcos-packet-cluster-ip-whitelisting-ipset", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60.0, "url" : "https://info.container-solutions.com/hubfs/Container_Solutions_Logo.png", "width" : 197.59778 }, "name" : "Cloud Native Blog " } } ```