ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Simplify firewall IP and network lists

Browse Source
This commit is contained in:
Ryan Cavicchioni
2019-11-28 22:47:59 -06:00
parent 2c7182fe37
commit 3d8e67e686
5 changed files with 83 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
roles/firewall/defaults/main.yaml
View File

@@ -59,10 +59,10 @@ firewall_limit_icmp_flood_hitcount: 6
firewall_loopback_notrack: true firewall_loopback_notrack: true
firewall_limited_tcp_ports: {} firewall_limited_tcp_ports: []
firewall_allowed_tcp_ports: {} firewall_allowed_tcp_ports: []
firewall_allowed_udp_ports: {} firewall_allowed_udp_ports: []
firewall_log_limit: 3/min firewall_log_limit: 3/min
firewall_log_limit_burst: 10 firewall_log_limit_burst: 10
@@ -73,52 +73,53 @@ firewall_limit_ssh_hitcount: 10
firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}" firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"
firewall_ssh_whitelist: {} firewall_ssh_whitelist: []
# ipset's # ipset's
firewall_ipset_cooloff_timeout: 600 firewall_ipset_cooloff_timeout: 600
firewall_ipset_blacklist: {} firewall_ipset_blacklist: []
firewall_ipset_mgmt: {} firewall_ipset_mgmt: []
firewall_ipset_bogons: firewall_ipset_bogons:
v4: - 0.0.0.0/8
- 0.0.0.0/8 - 10.0.0.0/8
- 10.0.0.0/8 - 100.64.0.0/10
- 100.64.0.0/10 - 127.0.0.0/8
- 127.0.0.0/8 - 169.254.0.0/16
- 169.254.0.0/16 - 172.16.0.0/12
- 172.16.0.0/12 - 192.0.0.0/24
- 192.0.0.0/24 - 192.0.2.0/24
- 192.0.2.0/24 - 192.168.0.0/16
- 192.168.0.0/16 - 198.18.0.0/15
- 198.18.0.0/15 - 198.51.100.0/24
- 198.51.100.0/24 - 203.0.113.0/24
- 203.0.113.0/24 - 224.0.0.0/4
- 224.0.0.0/4 - 240.0.0.0/4
- 240.0.0.0/4 - ::/96
v6: - ::/128
- ::/96 - ::1/128
- ::/128 - ::ffff:0.0.0.0/96
- ::1/128 - ::224.0.0.0/100
- ::ffff:0.0.0.0/96 - ::127.0.0.0/104
- ::224.0.0.0/100 - ::0.0.0.0/104
- ::127.0.0.0/104 - ::255.0.0.0/104
- ::0.0.0.0/104 - 0000::/8
- ::255.0.0.0/104 - 0200::/7
- 0000::/8 - 3ffe::/16
- 0200::/7 - 2001:db8::/32
- 3ffe::/16 - 2002:e000::/20
- 2001:db8::/32 - 2002:7f00::/24
- 2002:e000::/20 - 2002:0000::/24
- 2002:7f00::/24 - 2002:ff00::/24
- 2002:0000::/24 - 2002:0a00::/24
- 2002:ff00::/24 - 2002:ac10::/28
- 2002:0a00::/24 - 2002:c0a8::/32
- 2002:ac10::/28 - fc00::/7
- 2002:c0a8::/32 - fe80::/10
- fc00::/7 - fec0::/10
- fe80::/10 - ff00::/8
- fec0::/10
- ff00::/8 firewall_allowed_icmp_types: []
firewall_allowed_icmpv6_types: []

18
roles/firewall/templates/ip6tables.j2
View File

@@ -50,19 +50,19 @@
-A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
{% if firewall_ssh_whitelist.v6 %} {% if firewall_ssh_whitelist | length %}
{% for ip in firewall_ssh_whitelist.v6 %} {% for ip in firewall_ssh_whitelist | ipv6 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %} {% endif %}
{% if firewall_ipset_mgmt.v6 is defined %} {% if firewall_ipset_mgmt | length %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
{% endif %} {% endif %}
-A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
{% if firewall_ipset_blacklist.v6 is defined %} {% if firewall_ipset_blacklist | length %}
-A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP -A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
{% endif %} {% endif %}
@@ -96,7 +96,7 @@
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 148" -j ACCEPT -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 148" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT
{% if firewall_ipset_bogons.v6 is defined %} {% if firewall_ipset_bogons | length %}
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
{% endif %} {% endif %}
@@ -106,13 +106,17 @@
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
{% endif %} {% endif %}
{% for port in firewall_allowed_tcp_ports.v6 | default([]) %} {% if firewall_allowed_tcp_ports | length %}
{% for port in firewall_allowed_tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %}
{% for port in firewall_allowed_udp_ports.v6 | default([]) %} {% if firewall_allowed_udp_ports | length %}
{% for port in firewall_allowed_udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp6" -j ACCEPT -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp6" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %}
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT

10
roles/firewall/templates/ipset.v4.j2
View File

@@ -1,15 +1,17 @@
{% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %} {% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
flush {{ name }} flush {{ name }}
{% for ip_or_net in ipset | default([]) %} {% if ipset | length %}
{% for ip_or_net in ipset | ipv4 %}
add {{ name }} {{ ip_or_net }} add {{ name }} {{ ip_or_net }}
{% endfor %} {% endfor %}
{% endif %}
{% endmacro %} {% endmacro %}
{{ render_ipset(firewall_ipset_mgmt.v4, 'mgmt_v4') }} {{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }}
{{ render_ipset(firewall_ipset_blacklist.v4, 'blacklist_v4') }} {{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }}
{{ render_ipset(firewall_ipset_bogons.v4, 'bogons_v4') }} {{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }}
{{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} {{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}

10
roles/firewall/templates/ipset.v6.j2
View File

@@ -1,15 +1,17 @@
{% macro render_ipset(ipset, name, type="hash:net", family="inet6", timeout=None) %} {% macro render_ipset(ipset, name, type="hash:net", family="inet6", timeout=None) %}
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
flush {{ name }} flush {{ name }}
{% for ip_or_net in ipset | default([]) %} {% if ipset | length %}
{% for ip_or_net in ipset | ipv6 %}
add {{ name }} {{ ip_or_net }} add {{ name }} {{ ip_or_net }}
{% endfor %} {% endfor %}
{% endif %}
{% endmacro %} {% endmacro %}
{{ render_ipset(firewall_ipset_mgmt.v6, 'mgmt_v6') }} {{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }}
{{ render_ipset(firewall_ipset_blacklist.v6, 'blacklist_v6') }} {{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }}
{{ render_ipset(firewall_ipset_bogons.v6, 'bogons_v6') }} {{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }}
{{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} {{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}

22
roles/firewall/templates/iptables.j2
View File

@@ -50,23 +50,23 @@
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
{% if firewall_ssh_whitelist.v4 %} {% if firewall_ssh_whitelist | length %}
{% for ip in firewall_ssh_whitelist.v4 %} {% for ip in firewall_ssh_whitelist | ipv4 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %} {% endif %}
{% if firewall_ipset_mgmt.v4 is defined %} {% if firewall_ipset_mgmt | length %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
{% endif %} {% endif %}
-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
{% if firewall_ipset_blacklist.v4 is defined %} {% if firewall_ipset_blacklist | length %}
-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP -A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
{% endif %} {% endif %}
{% if firewall_ipset_bogons.v4 is defined %} {% if firewall_ipset_bogons | length %}
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
{% endif %} {% endif %}
@@ -80,9 +80,11 @@
{% endif %} {% endif %}
-A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
{% for type in firewall_allowed_icmp_types.v4 | default([]) %} {% if firewall_allowed_icmp_types | length %}
{% for type in firewall_allowed_icmp_types | ipv4 %}
-A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %}
{% if firewall_limit_ssh %} {% if firewall_limit_ssh %}
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j LIMIT_SSH -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j LIMIT_SSH
@@ -90,13 +92,17 @@
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
{% endif %} {% endif %}
{% for port in firewall_allowed_tcp_ports.v4 | default([]) %} {% if firewall_allowed_tcp_ports | length %}
{% for port in firewall_allowed_tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %}
{% for port in firewall_allowed_udp_ports.v4 | default([]) %} {% if firewall_allowed_udp_ports | length %}
{% for port in firewall_allowed_udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %}
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT