Firewall rules 

We have 3 groups (# of hosts per site):

- aggregator (1)
- mdq (2)
- haproxy (1)

1. aggregator expose port 80 to md
2. mdq exposes 443 to haproxy
3. haproxy exposes 443 to Internets