Firewalling debian.org hosts

Debian's own firewalling

A number of hosts have incoming ssh connections restricted to some subnets. In particular, this includes mirrors, buildds and DSA's gitolite host. To connect to those machines, users can hop through master.debian.org or people.debian.org.

Third party firewalling

In Debian we rely on sponsors for providing housing and hosting for all of our infrastructure. As such, we have a lot of our gear spread out all over the world across many different locations.

To make our life easier our general preference is that our kind sponsors give us unfiltered internet. That means no firewall, no blocking of any ports or protocols, no blocking of ICMP, no protocol enforcement/cleanup and no state tracking and killing sessions that appear to be idle. We are fortunate that most places are able to provide this.

We also acknowledge that sometimes local policies outside of our primary hosting provider require a less optimal setup (e.g. the Computer Science department hosts our machine but central IT which controls the University's border routers think ICMP is the devil's doing).

In these cases we usually ask for the following setup:

Extra ports might be required for specific services.

Wed, 27 May 2020 17:37:24 +0000