ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Add iptable SSH whitelist

Browse Source
This commit is contained in:
Ryan Cavicchioni 2019-11-24 19:10:21 -06:00
parent 4ddd1ed439
commit 13d12faa86
Signed by: ryanc
GPG Key ID: 877EEDAF9245103D
3 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
roles/firewall/defaults/main.yaml
View File

@ -64,6 +64,8 @@ firewall_limit_ssh_hitcount: 10
firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}" firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"
firewall_ssh_whitelist: {}
# ipset's # ipset's
firewall_ipset_cooloff_timeout: 600 firewall_ipset_cooloff_timeout: 600

8
roles/firewall/templates/ip6tables.j2
View File

@ -50,12 +50,18 @@
-A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
-A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP {% if firewall_ssh_whitelist.v6 %}
{% for ip in firewall_ssh_whitelist.v6 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
{% endfor %}
{% endif %}
{% if firewall_ipset_mgmt.v6 is defined %} {% if firewall_ipset_mgmt.v6 is defined %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
{% endif %} {% endif %}
-A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
{% if firewall_ipset_blacklist.v6 is defined %} {% if firewall_ipset_blacklist.v6 is defined %}
-A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP -A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
{% endif %} {% endif %}

8
roles/firewall/templates/iptables.j2
View File

@ -50,12 +50,18 @@
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP {% if firewall_ssh_whitelist.v4 %}
{% for ip in firewall_ssh_whitelist.v4 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
{% endfor %}
{% endif %}
{% if firewall_ipset_mgmt.v4 is defined %} {% if firewall_ipset_mgmt.v4 is defined %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
{% endif %} {% endif %}
-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
{% if firewall_ipset_blacklist.v4 is defined %} {% if firewall_ipset_blacklist.v4 is defined %}
-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP -A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
{% endif %} {% endif %}