From 3d8e67e6863ff15ae2e80027f2e1c402fcda4bac Mon Sep 17 00:00:00 2001 From: Ryan Cavicchioni Date: Thu, 28 Nov 2019 22:47:59 -0600 Subject: [PATCH] Simplify firewall IP and network lists --- roles/firewall/defaults/main.yaml | 91 ++++++++++++++------------- roles/firewall/templates/ip6tables.j2 | 18 +++--- roles/firewall/templates/ipset.v4.j2 | 10 +-- roles/firewall/templates/ipset.v6.j2 | 10 +-- roles/firewall/templates/iptables.j2 | 22 ++++--- 5 files changed, 83 insertions(+), 68 deletions(-) diff --git a/roles/firewall/defaults/main.yaml b/roles/firewall/defaults/main.yaml index 1737348..59c2f24 100644 --- a/roles/firewall/defaults/main.yaml +++ b/roles/firewall/defaults/main.yaml @@ -59,10 +59,10 @@ firewall_limit_icmp_flood_hitcount: 6 firewall_loopback_notrack: true -firewall_limited_tcp_ports: {} +firewall_limited_tcp_ports: [] -firewall_allowed_tcp_ports: {} -firewall_allowed_udp_ports: {} +firewall_allowed_tcp_ports: [] +firewall_allowed_udp_ports: [] firewall_log_limit: 3/min firewall_log_limit_burst: 10 @@ -73,52 +73,53 @@ firewall_limit_ssh_hitcount: 10 firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}" -firewall_ssh_whitelist: {} +firewall_ssh_whitelist: [] # ipset's firewall_ipset_cooloff_timeout: 600 -firewall_ipset_blacklist: {} +firewall_ipset_blacklist: [] -firewall_ipset_mgmt: {} +firewall_ipset_mgmt: [] firewall_ipset_bogons: - v4: - - 0.0.0.0/8 - - 10.0.0.0/8 - - 100.64.0.0/10 - - 127.0.0.0/8 - - 169.254.0.0/16 - - 172.16.0.0/12 - - 192.0.0.0/24 - - 192.0.2.0/24 - - 192.168.0.0/16 - - 198.18.0.0/15 - - 198.51.100.0/24 - - 203.0.113.0/24 - - 224.0.0.0/4 - - 240.0.0.0/4 - v6: - - ::/96 - - ::/128 - - ::1/128 - - ::ffff:0.0.0.0/96 - - ::224.0.0.0/100 - - ::127.0.0.0/104 - - ::0.0.0.0/104 - - ::255.0.0.0/104 - - 0000::/8 - - 0200::/7 - - 3ffe::/16 - - 2001:db8::/32 - - 2002:e000::/20 - - 2002:7f00::/24 - - 2002:0000::/24 - - 2002:ff00::/24 - - 2002:0a00::/24 - - 2002:ac10::/28 - - 2002:c0a8::/32 - - fc00::/7 - - fe80::/10 - - fec0::/10 - - ff00::/8 + - 0.0.0.0/8 + - 10.0.0.0/8 + - 100.64.0.0/10 + - 127.0.0.0/8 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.0.0.0/24 + - 192.0.2.0/24 + - 192.168.0.0/16 + - 198.18.0.0/15 + - 198.51.100.0/24 + - 203.0.113.0/24 + - 224.0.0.0/4 + - 240.0.0.0/4 + - ::/96 + - ::/128 + - ::1/128 + - ::ffff:0.0.0.0/96 + - ::224.0.0.0/100 + - ::127.0.0.0/104 + - ::0.0.0.0/104 + - ::255.0.0.0/104 + - 0000::/8 + - 0200::/7 + - 3ffe::/16 + - 2001:db8::/32 + - 2002:e000::/20 + - 2002:7f00::/24 + - 2002:0000::/24 + - 2002:ff00::/24 + - 2002:0a00::/24 + - 2002:ac10::/28 + - 2002:c0a8::/32 + - fc00::/7 + - fe80::/10 + - fec0::/10 + - ff00::/8 + +firewall_allowed_icmp_types: [] +firewall_allowed_icmpv6_types: [] diff --git a/roles/firewall/templates/ip6tables.j2 b/roles/firewall/templates/ip6tables.j2 index 94a9450..0993144 100644 --- a/roles/firewall/templates/ip6tables.j2 +++ b/roles/firewall/templates/ip6tables.j2 @@ -50,19 +50,19 @@ -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT -{% if firewall_ssh_whitelist.v6 %} -{% for ip in firewall_ssh_whitelist.v6 %} +{% if firewall_ssh_whitelist | length %} +{% for ip in firewall_ssh_whitelist | ipv6 %} -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT {% endfor %} {% endif %} -{% if firewall_ipset_mgmt.v6 is defined %} +{% if firewall_ipset_mgmt | length %} -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT {% endif %} -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP -{% if firewall_ipset_blacklist.v6 is defined %} +{% if firewall_ipset_blacklist | length %} -A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP {% endif %} @@ -96,7 +96,7 @@ -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 148" -j ACCEPT -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT -{% if firewall_ipset_bogons.v6 is defined %} +{% if firewall_ipset_bogons | length %} -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP {% endif %} @@ -106,13 +106,17 @@ -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT {% endif %} -{% for port in firewall_allowed_tcp_ports.v6 | default([]) %} +{% if firewall_allowed_tcp_ports | length %} +{% for port in firewall_allowed_tcp_ports %} -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT {% endfor %} +{% endif %} -{% for port in firewall_allowed_udp_ports.v6 | default([]) %} +{% if firewall_allowed_udp_ports | length %} +{% for port in firewall_allowed_udp_ports %} -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp6" -j ACCEPT {% endfor %} +{% endif %} -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT diff --git a/roles/firewall/templates/ipset.v4.j2 b/roles/firewall/templates/ipset.v4.j2 index 81c963a..8804754 100644 --- a/roles/firewall/templates/ipset.v4.j2 +++ b/roles/firewall/templates/ipset.v4.j2 @@ -1,15 +1,17 @@ {% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %} create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist flush {{ name }} -{% for ip_or_net in ipset | default([]) %} +{% if ipset | length %} +{% for ip_or_net in ipset | ipv4 %} add {{ name }} {{ ip_or_net }} {% endfor %} +{% endif %} {% endmacro %} -{{ render_ipset(firewall_ipset_mgmt.v4, 'mgmt_v4') }} +{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }} -{{ render_ipset(firewall_ipset_blacklist.v4, 'blacklist_v4') }} +{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }} -{{ render_ipset(firewall_ipset_bogons.v4, 'bogons_v4') }} +{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }} {{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} diff --git a/roles/firewall/templates/ipset.v6.j2 b/roles/firewall/templates/ipset.v6.j2 index 7520594..32fab0e 100644 --- a/roles/firewall/templates/ipset.v6.j2 +++ b/roles/firewall/templates/ipset.v6.j2 @@ -1,15 +1,17 @@ {% macro render_ipset(ipset, name, type="hash:net", family="inet6", timeout=None) %} create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist flush {{ name }} -{% for ip_or_net in ipset | default([]) %} +{% if ipset | length %} +{% for ip_or_net in ipset | ipv6 %} add {{ name }} {{ ip_or_net }} {% endfor %} +{% endif %} {% endmacro %} -{{ render_ipset(firewall_ipset_mgmt.v6, 'mgmt_v6') }} +{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }} -{{ render_ipset(firewall_ipset_blacklist.v6, 'blacklist_v6') }} +{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }} -{{ render_ipset(firewall_ipset_bogons.v6, 'bogons_v6') }} +{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }} {{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2 index 9e109e6..5a38591 100644 --- a/roles/firewall/templates/iptables.j2 +++ b/roles/firewall/templates/iptables.j2 @@ -50,23 +50,23 @@ -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT -{% if firewall_ssh_whitelist.v4 %} -{% for ip in firewall_ssh_whitelist.v4 %} +{% if firewall_ssh_whitelist | length %} +{% for ip in firewall_ssh_whitelist | ipv4 %} -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT {% endfor %} {% endif %} -{% if firewall_ipset_mgmt.v4 is defined %} +{% if firewall_ipset_mgmt | length %} -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT {% endif %} -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP -{% if firewall_ipset_blacklist.v4 is defined %} +{% if firewall_ipset_blacklist | length %} -A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP {% endif %} -{% if firewall_ipset_bogons.v4 is defined %} +{% if firewall_ipset_bogons | length %} -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP {% endif %} @@ -80,9 +80,11 @@ {% endif %} -A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT -{% for type in firewall_allowed_icmp_types.v4 | default([]) %} +{% if firewall_allowed_icmp_types | length %} +{% for type in firewall_allowed_icmp_types | ipv4 %} -A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT {% endfor %} +{% endif %} {% if firewall_limit_ssh %} -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j LIMIT_SSH @@ -90,13 +92,17 @@ -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT {% endif %} -{% for port in firewall_allowed_tcp_ports.v4 | default([]) %} +{% if firewall_allowed_tcp_ports | length %} +{% for port in firewall_allowed_tcp_ports %} -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT {% endfor %} +{% endif %} -{% for port in firewall_allowed_udp_ports.v4 | default([]) %} +{% if firewall_allowed_udp_ports | length %} +{% for port in firewall_allowed_udp_ports %} -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT {% endfor %} +{% endif %} -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT