From 3b5c2242d138715ee750bd112eb647261d906f99 Mon Sep 17 00:00:00 2001
From: Ryan Cavicchioni <ryan@cavi.cc>
Date: Wed, 1 Jan 2020 11:19:19 -0600
Subject: [PATCH] add iptables whitelist for DNS

---
 roles/firewall/templates/ip6tables.j2 | 15 +++++++++++++++
 roles/firewall/templates/iptables.j2  | 15 +++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/roles/firewall/templates/ip6tables.j2 b/roles/firewall/templates/ip6tables.j2
index 0993144..a6aee5b 100644
--- a/roles/firewall/templates/ip6tables.j2
+++ b/roles/firewall/templates/ip6tables.j2
@@ -48,6 +48,13 @@
 -A ICMP_FLOOD -j ACCEPT
 {% endif %}
 
+{% if firewall_dns_whitelist is defined %}
+-N ACCEPT_DNS
+-A ACCEPT_DNS -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp6" -j LOG_ACCEPT
+-A ACCEPT_DNS -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp6" -j LOG_ACCEPT
+-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop inet6" -j LOG_DROP
+{% endif %}
+
 -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -60,6 +67,14 @@
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
+{% if firewall_dns_whitelist is defined and
+      firewall_dns_whitelist | length %}
+{% for ip in firewall_dns_whitelist | ipv6 %}
+-A INPUT -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp6" -j ACCEPT_DNS
+-A INPUT -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp6" -j ACCEPT_DNS
+{% endfor %}
+{% endif %}
+
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
 
 {% if firewall_ipset_blacklist | length %}
diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2
index 5a38591..4c50f78 100644
--- a/roles/firewall/templates/iptables.j2
+++ b/roles/firewall/templates/iptables.j2
@@ -48,6 +48,13 @@
 -A ICMP_FLOOD -j ACCEPT
 {% endif %}
 
+{% if firewall_dns_whitelist is defined %}
+-N ACCEPT_DNS
+-A ACCEPT_DNS -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j LOG_ACCEPT
+-A ACCEPT_DNS -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j LOG_ACCEPT
+-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
+{% endif %}
+
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -60,6 +67,14 @@
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
 {% endif %}
 
+{% if firewall_dns_whitelist is defined and
+      firewall_dns_whitelist | length %}
+{% for ip in firewall_dns_whitelist | ipv4 %}
+-A INPUT -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j ACCEPT_DNS
+-A INPUT -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j ACCEPT_DNS
+{% endfor %}
+{% endif %}
+
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
 
 {% if firewall_ipset_blacklist | length %}