postgresql-fw.sh

#!/usr/bin/env bash
DB_MASTER=xxx
DB_BACKUP=yyy

# server
iptables -A INPUT -p tcp -s $DB_BACKUP --sport 1024:65535 -d $DB_MASTER --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $DB_MASTER --sport 5432 -d $DB_BACKUP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

#client
iptables -A OUTPUT -p tcp -s $DB_MASTER --sport 1024:65535 -d 0/0 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 5432 -d $DB_MASTER --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp -s 0/0 --sport 0:65535 -d $DB_MASTER --dport 5432 -j TARPIT

# SLAVE

#!/usr/bin/env bash
DB_MASTER=xxx
DB_BACKUP=yyy

# server
iptables -A INPUT -p tcp -s $DB_MASTER --sport 1024:65535 -d $DB_BACKUP --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $DB_BACKUP --sport 5432 -d $DB_MASTER --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

#client
iptables -A OUTPUT -p tcp -s $DB_BACKUP --sport 1024:65535 -d 0/0 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 5432 -d $DB_BACKUP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp -s 0/0 --sport 0:65535 -d $DB_BACKUP --dport 5432 -j REJECT