From 621ae59e636686f59ac7fdd38d4bf36267a87ce6 Mon Sep 17 00:00:00 2001 From: Ryan Cavicchioni Date: Tue, 30 Aug 2022 07:22:53 -0500 Subject: [PATCH] Use ipsets for the firewall --- roles/firewall/defaults/main.yaml | 3 +- roles/firewall/handlers/main.yaml | 17 ++-- roles/firewall/tasks/main.yaml | 19 +--- roles/firewall/templates/ip6tables.j2 | 81 +++++++++++------ roles/firewall/templates/ipset.j2 | 48 ++++++++++ roles/firewall/templates/ipset.v4.j2 | 28 +++++- roles/firewall/templates/ipset.v6.j2 | 28 +++++- roles/firewall/templates/iptables.j2 | 122 +++++++++++++++----------- 8 files changed, 235 insertions(+), 111 deletions(-) create mode 100644 roles/firewall/templates/ipset.j2 diff --git a/roles/firewall/defaults/main.yaml b/roles/firewall/defaults/main.yaml index 59c2f24..8d0551d 100644 --- a/roles/firewall/defaults/main.yaml +++ b/roles/firewall/defaults/main.yaml @@ -2,6 +2,7 @@ firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp +firewall_ipset: /etc/iptables/ipset-tmp firewall_ipset_v4: /etc/iptables/ipset.v4-tmp firewall_ipset_v6: /etc/iptables/ipset.v6-tmp @@ -68,7 +69,7 @@ firewall_log_limit: 3/min firewall_log_limit_burst: 10 firewall_limit_ssh: true -firewall_limit_ssh_seconds: 60 +firewall_limit_ssh_seconds: 600 firewall_limit_ssh_hitcount: 10 firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}" diff --git a/roles/firewall/handlers/main.yaml b/roles/firewall/handlers/main.yaml index d67082e..a2dd319 100644 --- a/roles/firewall/handlers/main.yaml +++ b/roles/firewall/handlers/main.yaml @@ -13,21 +13,18 @@ - name: ip6tables-restore command: ip6tables-restore {{ firewall_iptables_rules_v6 }} +- name: reload ipset + shell: ipset restore -exist -file {{ firewall_ipset }} + - name: restart firewall v4 - command: "{{ item }}" + shell: "{{ item }}" loop: - - iptables-restore /etc/iptables/clear.v4 - - ipset restore -file {{ firewall_ipset_v4 }} - - iptables-restore --test {{ firewall_iptables_rules_v4 }} - - iptables-restore {{ firewall_iptables_rules_v4 }} + - iptables-restore --test {{ firewall_iptables_rules_v4 }} && iptables-restore {{ firewall_iptables_rules_v4 }} - name: restart firewall v6 - command: "{{ item }}" + shell: "{{ item }}" loop: - - ip6tables-restore /etc/iptables/clear.v6 - - ipset restore -file {{ firewall_ipset_v6 }} - - ip6tables-restore --test {{ firewall_iptables_rules_v6 }} - - ip6tables-restore {{ firewall_iptables_rules_v6 }} + - ip6tables-restore --test {{ firewall_iptables_rules_v6 }} && ip6tables-restore {{ firewall_iptables_rules_v6 }} - name: iptables-persistent command: /usr/sbin/netfilter-persistent save diff --git a/roles/firewall/tasks/main.yaml b/roles/firewall/tasks/main.yaml index b19ee89..632a2cc 100644 --- a/roles/firewall/tasks/main.yaml +++ b/roles/firewall/tasks/main.yaml @@ -63,15 +63,15 @@ - clear.v4 - clear.v6 -- name: configure IPv4 ipsets +- name: configure ipsets template: - src: ipset.v4.j2 - dest: "{{ firewall_ipset_v4 }}" + src: ipset.j2 + dest: "{{ firewall_ipset }}" owner: root group: root mode: 0600 notify: - - restart firewall v4 + - reload ipset - iptables-persistent - name: configure IPv4 firewall @@ -85,17 +85,6 @@ - restart firewall v4 - iptables-persistent -- name: configure IPv6 ipsets - template: - src: ipset.v6.j2 - dest: "{{ firewall_ipset_v6 }}" - owner: root - group: root - mode: 0600 - notify: - - restart firewall v6 - - iptables-persistent - - name: configure IPv6 firewall template: src: ip6tables.j2 diff --git a/roles/firewall/templates/ip6tables.j2 b/roles/firewall/templates/ip6tables.j2 index 8fee640..602bf0f 100644 --- a/roles/firewall/templates/ip6tables.j2 +++ b/roles/firewall/templates/ip6tables.j2 @@ -23,16 +23,31 @@ -A LOG_DROP -p udp -m udp -m comment --comment "drop udp6" -j DROP -A LOG_DROP -m comment --comment "reject all inet6" -j REJECT --reject-with icmp6-adm-prohibited +{% if "wireguard" in ansible_play_role_names %} +{% for name, conf in wireguard_interfaces.items() %} +-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT +{% endfor %} +{% for name, conf in wireguard_iptables.items() %} +{% if "input" in conf and conf.input %} +-A INPUT -i {{ name }} -j LOG_ACCEPT +{% endif %} +{% if "dns" in conf and conf.dns %} +-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT +-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT +{% endif %} +{% endfor %} +{% endif %} + {% if firewall_limit_ssh %} -N LIMIT_SSH --A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset +-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset -A LIMIT_SSH -m recent --set --name SSH --rsource {% if firewall_use_ulogd %} -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] " {% else %} -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info {% endif %} --A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v6 src +-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff6 src -A LIMIT_SSH -j ACCEPT {% endif %} @@ -48,16 +63,6 @@ -A ICMP_FLOOD -j ACCEPT {% endif %} -{% if firewall_dns_whitelist is defined and - firewall_dns_whitelist | length %} --N ACCEPT_DNS -{% for ip in firewall_dns_whitelist | ipv6 %} --A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT --A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT -{% endfor %} --A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP -{% endif %} - -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT {% if firewall_ssh_whitelist | length %} @@ -67,21 +72,13 @@ {% endif %} {% if firewall_ipset_mgmt | length %} --A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT -{% endif %} - -{% if firewall_dns_whitelist is defined and - firewall_dns_whitelist | length %} --A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS --A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS +-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT {% endif %} +-A INPUT -m set --match-set block6 src -m comment --comment "drop block6" -j LOG_DROP +-A INPUT -m set --match-set gray6 src -m comment --comment "drop gray6" -j LOG_DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP -{% if firewall_ipset_blacklist | length %} --A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP -{% endif %} - -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmpv6 130" -j ACCEPT -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmpv6 131" -j ACCEPT -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmpv6 132" -j ACCEPT @@ -113,7 +110,7 @@ -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT {% if firewall_ipset_bogons | length %} --A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP +-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP {% endif %} {% if firewall_limit_ssh %} @@ -122,6 +119,32 @@ -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT {% endif %} +{% if firewall_ipset_node_exporter is defined %} +-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter6 src -m comment --comment "accept node_exporter 9100/tcp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_blackbox_exporter is defined %} +-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter6 src -m comment --comment "accept blackbox_exporter 9115/tcp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_mtail is defined %} +-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail6 src -m comment --comment "accept mtail 3903/tcp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_syslog is defined %} +-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog6 src -m comment --comment "accept syslog 514/tcp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_influxdb is defined %} +-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb6 src -m comment --comment "accept influxdb 8086/tcp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_dns is defined %} +-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/tcp6" -j LOG_ACCEPT +-A INPUT -p udp -m udp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/udp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_loki is defined %} +-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki6 src -m comment --comment "accept loki 3100/tcp6" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_promtail is defined %} +-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail6 src -m comment --comment "accept promtail 9080/tcp6" -j LOG_ACCEPT +{% endif %} + {% if firewall_allowed_tcp_ports | length %} {% for port in firewall_allowed_tcp_ports %} -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT @@ -152,7 +175,15 @@ -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP --A FORWARD -m comment --comment "default forward drop inet6" -j LOG_DROP +{% if "wireguard" in ansible_play_role_names %} +{% for name, conf in wireguard_iptables.items() %} +{% if "forward" in conf and conf.forward %} +-A FORWARD -i {{ name }} -o eth0 -j ACCEPT +{% endif %} +{% endfor %} +{% endif %} +-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT +-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP -A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT COMMIT diff --git a/roles/firewall/templates/ipset.j2 b/roles/firewall/templates/ipset.j2 new file mode 100644 index 0000000..5164736 --- /dev/null +++ b/roles/firewall/templates/ipset.j2 @@ -0,0 +1,48 @@ +{% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %} +create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist +flush {{ name }} +{% if ipset is iterable %} +{% for ip_or_net in ipset %} +add {{ name }} {{ ip_or_net }} +{% endfor %} +{% endif %} +{% endmacro %} + +{% macro render_dual_stack_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %} +{{ render_ipset(ipset | ipv4, name + "4", type=type, family=family, timeout=timeout) }} +{{ render_ipset(ipset | ipv6, name + "6", type=type, family="inet6", timeout=timeout) }} +{% endmacro %} + +{{ render_dual_stack_ipset([], 'block') }} +{{ render_dual_stack_ipset([], 'gray', type="hash:ip", timeout=600) }} +{{ render_dual_stack_ipset([], 'cooloff', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} +{% if firewall_ipset_mgmt is defined %} +{{ render_dual_stack_ipset(firewall_ipset_mgmt, 'mgmt') }} +{% endif %} +{% if firewall_ipset_bogons is defined %} +{{ render_dual_stack_ipset(firewall_ipset_bogons, 'bogons') }} +{% endif %} +{% if firewall_ipset_node_exporter is defined %} +{{ render_dual_stack_ipset(firewall_ipset_node_exporter, 'node_exporter') }} +{% endif %} +{% if firewall_ipset_blackbox_exporter is defined %} +{{ render_dual_stack_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter') }} +{% endif %} +{% if firewall_ipset_mtail is defined %} +{{ render_dual_stack_ipset(firewall_ipset_mtail, 'mtail') }} +{% endif %} +{% if firewall_ipset_syslog is defined %} +{{ render_dual_stack_ipset(firewall_ipset_syslog, 'syslog') }} +{% endif %} +{% if firewall_ipset_influxdb is defined %} +{{ render_dual_stack_ipset(firewall_ipset_influxdb, 'influxdb') }} +{% endif %} +{% if firewall_ipset_dns is defined %} +{{ render_dual_stack_ipset(firewall_ipset_dns, 'dns') }} +{% endif %} +{% if firewall_ipset_loki is defined %} +{{ render_dual_stack_ipset(firewall_ipset_loki, 'loki') }} +{% endif %} +{% if firewall_ipset_promtail is defined %} +{{ render_dual_stack_ipset(firewall_ipset_promtail, 'promtail') }} +{% endif %} diff --git a/roles/firewall/templates/ipset.v4.j2 b/roles/firewall/templates/ipset.v4.j2 index 8804754..0e7dd77 100644 --- a/roles/firewall/templates/ipset.v4.j2 +++ b/roles/firewall/templates/ipset.v4.j2 @@ -8,10 +8,30 @@ add {{ name }} {{ ip_or_net }} {% endif %} {% endmacro %} -{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }} +{{ render_ipset(firewall_ipset_mgmt, 'mgmt4') }} -{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }} +{{ render_ipset([], 'blacklist4') }} +{{ render_ipset([], 'graylist4', type="hash:ip", timeout=600) }} -{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }} +{{ render_ipset(firewall_ipset_bogons, 'bogons4') }} -{{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} +{{ render_ipset([], 'cooloff4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} + +{% if firewall_ipset_node_exporter is defined %} +{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter4') }} +{% endif %} +{% if firewall_ipset_blackbox_exporter is defined %} +{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter4') }} +{% endif %} +{% if firewall_ipset_mtail is defined %} +{{ render_ipset(firewall_ipset_mtail, 'mtail4') }} +{% endif %} +{% if firewall_ipset_syslog is defined %} +{{ render_ipset(firewall_ipset_syslog, 'syslog4') }} +{% endif %} +{% if firewall_ipset_influxdb is defined %} +{{ render_ipset(firewall_ipset_influxdb, 'influxdb4') }} +{% endif %} +{% if firewall_ipset_dns is defined %} +{{ render_ipset(firewall_ipset_dns, 'dns4') }} +{% endif %} diff --git a/roles/firewall/templates/ipset.v6.j2 b/roles/firewall/templates/ipset.v6.j2 index 32fab0e..90596d2 100644 --- a/roles/firewall/templates/ipset.v6.j2 +++ b/roles/firewall/templates/ipset.v6.j2 @@ -8,10 +8,30 @@ add {{ name }} {{ ip_or_net }} {% endif %} {% endmacro %} -{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }} +{{ render_ipset(firewall_ipset_mgmt, 'mgmt6') }} -{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }} +{{ render_ipset([], 'blacklist6') }} +{{ render_ipset([], 'graylist6', type="hash:ip", timeout=600) }} -{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }} +{{ render_ipset(firewall_ipset_bogons, 'bogons6') }} -{{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} +{{ render_ipset([], 'cooloff6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} + +{% if firewall_ipset_node_exporter is defined %} +{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter6') }} +{% endif %} +{% if firewall_ipset_blackbox_exporter is defined %} +{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter6') }} +{% endif %} +{% if firewall_ipset_mtail is defined %} +{{ render_ipset(firewall_ipset_mtail, 'mtail6') }} +{% endif %} +{% if firewall_ipset_syslog is defined %} +{{ render_ipset(firewall_ipset_syslog, 'syslog6') }} +{% endif %} +{% if firewall_ipset_influxdb is defined %} +{{ render_ipset(firewall_ipset_influxdb, 'influxdb6') }} +{% endif %} +{% if firewall_ipset_dns is defined %} +{{ render_ipset(firewall_ipset_dns, 'dns6') }} +{% endif %} diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2 index 745e8e7..57f88fe 100644 --- a/roles/firewall/templates/iptables.j2 +++ b/roles/firewall/templates/iptables.j2 @@ -23,16 +23,31 @@ -A LOG_DROP -p udp -m udp -m comment --comment "drop udp" -j DROP -A LOG_DROP -m comment --comment "reject all" -j REJECT --reject-with icmp-admin-prohibited +{% if "wireguard" in ansible_play_role_names %} +{% for name, conf in wireguard_interfaces.items() %} +-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT +{% endfor %} +{% for name, conf in wireguard_iptables.items() %} +{% if "input" in conf and conf.input %} +-A INPUT -i {{ name }} -j LOG_ACCEPT +{% endif %} +{% if "dns" in conf and conf.dns %} +-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT +-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT +{% endif %} +{% endfor %} +{% endif %} + {% if firewall_limit_ssh %} -N LIMIT_SSH --A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset +-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset -A LIMIT_SSH -m recent --set --name SSH --rsource {% if firewall_use_ulogd %} -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] " {% else %} -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info {% endif %} --A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v4 src +-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff4 src -A LIMIT_SSH -j ACCEPT {% endif %} @@ -48,34 +63,6 @@ -A ICMP_FLOOD -j ACCEPT {% endif %} -{% if firewall_dns_whitelist is defined and - firewall_dns_whitelist | length %} --N ACCEPT_DNS -{% for ip in firewall_dns_whitelist | ipv4 %} --A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT --A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT -{% endfor %} --A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP -{% endif %} - -{% if firewall_influx_whitelist is defined and - firewall_influx_whitelist | length %} --N ACCEPT_INFLUX -{% for ip in firewall_influx_whitelist | ipv4 %} --A ACCEPT_INFLUX -m tcp -p tcp --dport 8086 --source {{ ip }} -m comment --comment "accept {{ ip }} influxdb 8086/tcp" -j LOG_ACCEPT -{% endfor %} --A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP -{% endif %} - -{% if firewall_syslog_whitelist is defined and - firewall_syslog_whitelist | length %} --N ACCEPT_SYSLOG -{% for ip in firewall_syslog_whitelist | ipv4 %} --A ACCEPT_SYSLOG -m tcp -p tcp --dport 514 --source {{ ip }} -m comment --comment "accept {{ ip }} syslog 514/tcp" -j LOG_ACCEPT -{% endfor %} --A ACCEPT_SYSLOG -m comment --comment "ACCEPT_SYSLOG default drop" -j LOG_DROP -{% endif %} - -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT {% if firewall_ssh_whitelist | length %} @@ -85,33 +72,15 @@ {% endif %} {% if firewall_ipset_mgmt | length %} --A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT -{% endif %} - -{% if firewall_dns_whitelist is defined and - firewall_dns_whitelist | length %} --A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS --A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS -{% endif %} - -{% if firewall_influx_whitelist is defined and - firewall_influx_whitelist | length %} --A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX -{% endif %} - -{% if firewall_syslog_whitelist is defined and - firewall_syslog_whitelist | length %} --A INPUT -m tcp -p tcp --dport 514 -m comment --comment "accept syslog 514/tcp" -j ACCEPT_SYSLOG +-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT {% endif %} +-A INPUT -m set --match-set block4 src -m comment --comment "drop block4" -j LOG_DROP +-A INPUT -m set --match-set gray4 src -m comment --comment "drop gray4" -j LOG_DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP -{% if firewall_ipset_blacklist | length %} --A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP -{% endif %} - {% if firewall_ipset_bogons | length %} --A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP +-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons4 src,dst -m comment --comment "drop bogons" -j LOG_DROP {% endif %} -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT @@ -136,6 +105,33 @@ -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT {% endif %} +{% if firewall_ipset_node_exporter is defined %} +-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter4 src -m comment --comment "accept node_exporter 9100/tcp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_blackbox_exporter is defined %} +-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter4 src -m comment --comment "accept blackbox_exporter 9115/tcp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_mtail is defined %} +-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail4 src -m comment --comment "accept mtail 3903/tcp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_syslog is defined %} +-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/tcp" -j LOG_ACCEPT +-A INPUT -p udp -m udp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/udp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_influxdb is defined %} +-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb4 src -m comment --comment "accept influxdb 8086/tcp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_dns is defined %} +-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/tcp" -j LOG_ACCEPT +-A INPUT -p udp -m udp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/udp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_loki is defined %} +-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki4 src -m comment --comment "accept loki 3100/tcp" -j LOG_ACCEPT +{% endif %} +{% if firewall_ipset_promtail is defined %} +-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail4 src -m comment --comment "accept promtail 9080/tcp" -j LOG_ACCEPT +{% endif %} + {% if firewall_allowed_tcp_ports | length %} {% for port in firewall_allowed_tcp_ports %} -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT @@ -166,6 +162,14 @@ -A INPUT -m comment --comment "default drop" -j LOG_DROP +{% if "wireguard" in ansible_play_role_names %} +{% for name, conf in wireguard_iptables.items() %} +{% if "forward" in conf and conf.forward %} +-A FORWARD -i {{ name }} -o eth0 -j ACCEPT +{% endif %} +{% endfor %} +{% endif %} +-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT -A FORWARD -m comment --comment "default forward drop" -j LOG_DROP -A OUTPUT -m comment --comment "default output accept" -j ACCEPT @@ -180,4 +184,18 @@ COMMIT {% endif %} COMMIT +*nat +:PREROUTING ACCEPT - +:INPUT ACCEPT - +:OUTPUT ACCEPT - +:POSTROUTING ACCEPT - + +{% if "wireguard" in ansible_play_role_names %} +{% for name, conf in wireguard_iptables.items() %} +{% if "nat" in conf %} +-A POSTROUTING -o {{ conf.nat.out_iface }} -s {{ conf.nat.source }} -j MASQUERADE +{% endif %} +{% endfor %} +{% endif %} +COMMIT # vim: tw=0