I tried using the below IPTABLES config(a few of the ports are changed), however, the endorser missed a block this morning, I think the IPTABLES rules are preventing it from talking to the node, but I'm not sure.
Allow related connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Allow loopback interface
iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
Allow SSH for now, so our connection is not disrupted, we will enable/disable SSH access via our security groups on the cloud provider. We will tighten this up in future versions
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
Allow Tezos P2P connections
iptables -A INPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9732 -m conntrack --ctstate ESTABLISHED -j ACCEPT
Allow NBD
iptables -A OUTPUT -p tcp --dport $MY_NBD_PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
Allow DNS
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
Allow NTP
iptables -A INPUT -p udp --source-port 123:123 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p udp --destination-port 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT
Allow DHCP
iptables -A INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
Setup loggers
iptables -N LOG_AND_DROP_IN iptables -A LOG_AND_DROP_IN -j LOG --log-prefix "IPTABLES:DROP:IN:" iptables -A LOG_AND_DROP_IN -j DROP
iptables -N LOG_AND_DROP_OUT iptables -A LOG_AND_DROP_OUT -j LOG --log-prefix "IPTABLES:DROP:OUT:" iptables -A LOG_AND_DROP_OUT -j DROP
iptables -N LOG_AND_DROP_FWD iptables -A LOG_AND_DROP_FWD -j LOG --log-prefix "IPTABLES:DROP:FWD:" iptables -A LOG_AND_DROP_FWD -j DROP
Log and drop everything else
iptables -A INPUT -j LOG_AND_DROP_IN iptables -A FORWARD -j LOG_AND_DROP_FWD iptables -A OUTPUT -j LOG_AND_DROP_OUT
Default to drop everything
iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP