UFW - Profiling Veeam Proxy#

# ============================================
# SSH ACCESS
# ============================================
sudo ufw allow proto tcp from 10.25.4.2 to any port 22 comment 'allow ssh from bastion Tailscale'
sudo ufw allow proto tcp from 10.186.3.4 to any port 22 comment 'allow ssh from GCP Tailscale'
sudo ufw allow proto tcp from 10.25.4.251 to any port 22 comment 'allow ssh from ansible.trimegah.cloud'
sudo ufw allow proto tcp from 10.25.4.69 to any port 22 comment 'allow ssh from network-tools vm'
sudo ufw allow proto tcp from 10.25.102.100 to any port 22 comment 'allow ssh from jumpserver'

# ============================================
# MONITORING - NETDATA
# ============================================
sudo ufw allow proto tcp from 10.25.100.0/24 to any port 19999 comment 'allow netdata from Alloy'

# ============================================
# VEEAM - CONTROL CHANNEL (6162)
# ============================================
sudo ufw allow proto tcp from 10.25.12.50 to any port 6162 comment 'allow communication request veeam from vbr 10.25.12.50'
sudo ufw allow proto tcp from 10.25.12.51 to any port 6162 comment 'allow communication request veeam from vbr console 10.25.12.51'

# ============================================
# VEEAM - INSTALLER SERVICE (6160)
# ============================================
sudo ufw allow proto tcp from 10.25.12.50 to any port 6160 comment 'allow communication request config installation veeam from vbr 10.25.12.50'
sudo ufw allow proto tcp from 10.25.12.51 to any port 6160 comment 'allow communication request config installation veeam from vbr console 10.25.12.51'

# ============================================
# VEEAM - DATA TRANSFER CHANNEL (2500-3300)
# ============================================
sudo ufw allow proto tcp from 10.25.3.110 to any port 2500:3300 comment 'allow communication exchanges veeam from veeam worker nutanix'
sudo ufw allow proto tcp from 10.25.12.252 to any port 2500:3300 comment 'allow communication exchanges veeam from veeam proxy 02'
sudo ufw allow proto tcp from 10.25.12.251 to any port 2500:3300 comment 'allow communication exchanges veeam from veeam proxy 01'
sudo ufw allow proto tcp from 10.25.12.50 to any port 2500:3300 comment 'allow communication exchanges veeam from veeam vbr'
sudo ufw allow proto tcp from 10.25.12.51 to any port 2500:3300 comment 'allow communication exchanges veeam from veeam vbr console'
sudo ufw allow proto tcp from 10.25.12.253 to any port 2500:3300 comment 'allow communication exchanges restore veeam from veeam hardened repository 01'
sudo ufw allow proto tcp from 10.25.12.254 to any port 2500:3300 comment 'allow communication exchanges restore veeam from veeam hardened repository 02'

# ============================================
# MONITORING - SNMP (LibreNMS)
# ============================================
sudo ufw allow proto udp from 10.25.112.130 to any port 161 comment 'allow snmp from librenms k8s'
sudo ufw allow proto udp from 10.25.112.143 to any port 161 comment 'allow snmp from librenms k8s'
sudo ufw allow proto udp from 10.25.112.132 to any port 161 comment 'allow snmp from librenms k8s'

# ============================================
# RELOAD
# ============================================
sudo ufw reload