security - Digital Ocean VPC Droplets 无法相互连接

Question

我创建了一个包含 4 个 Droplet 的 VPC：一个仅允许来自单个 IP 的 ssh 的堡垒、一个公共 Web 服务器、一个为公共 Web 服务器提供数据的私有 CMS，以及一个静态加密的安全数据存储。我一直在研究防火墙规则，以允许 VPC 内的所有 Droplet 相互通信（ssh，443），但完全没有成功。

我有一个防火墙，允许从我们的 VPN IP SSH 进入堡垒 - 这非常有效。这个想法是先通过 ssh 进入堡垒，然后再进入其他液滴。

有一个 ssh 密钥，为每个 droplet 添加到 authorized_keys 中。

这是我的防火墙地形：

resource "digitalocean_firewall" "secure_network" {
    name = "secure-network"

    droplet_ids = [digitalocean_droplet.www-sds.id, digitalocean_droplet.www-fe.id, digitalocean_droplet.www-cms.id]

    inbound_rule {
        protocol = "tcp"
        port_range = "22"
        source_addresses = [digitalocean_droplet.bastion.ipv4_address_private]
    }

    outbound_rule {
        protocol = "icmp"
        destination_addresses = ["0.0.0.0/0", "::/0"]
    }
    outbound_rule {
        protocol = "tcp"
        port_range = "1-65535"
        destination_addresses = ["0.0.0.0/0", "::/0"]
    }
    outbound_rule {
        protocol = "udp"
        port_range = "1-65535"
        destination_addresses = ["0.0.0.0/0", "::/0"]
    }

}

resource "digitalocean_firewall" "vpn-only-access" {
    name = "vpn-only-access"
    
    droplet_ids = [digitalocean_droplet.bastion.id]
    
    inbound_rule {
        protocol = "tcp"
        port_range = "22"
        source_addresses = ["159.89.140.157"]
    }
}

resource "digitalocean_firewall" "public-access" {
    name = "public-access"
    droplet_ids = [digitalocean_droplet.www-fe.id]

    inbound_rule {
        protocol = "tcp"
        port_range = "443"
        source_addresses = [digitalocean_droplet.www-fe.ipv4_address]
    }

    inbound_rule {
        protocol = "tcp"
        port_range = "80"
        source_addresses = [digitalocean_droplet.www-fe.ipv4_address]
    }
}

标签： securitynetworkingsshterraformfirewall