ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Use ipsets for the firewall

Browse Source
This commit is contained in:
Ryan Cavicchioni 2022-08-30 07:22:53 -05:00
parent 2fdf1d7a25
commit 621ae59e63
Signed by: ryanc
GPG Key ID: 877EEDAF9245103D
8 changed files with 235 additions and 111 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
roles/firewall/defaults/main.yaml
View File

@ -2,6 +2,7 @@
firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp
firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp
firewall_ipset: /etc/iptables/ipset-tmp
firewall_ipset_v4: /etc/iptables/ipset.v4-tmp firewall_ipset_v4: /etc/iptables/ipset.v4-tmp
firewall_ipset_v6: /etc/iptables/ipset.v6-tmp firewall_ipset_v6: /etc/iptables/ipset.v6-tmp
@ -68,7 +69,7 @@ firewall_log_limit: 3/min
firewall_log_limit_burst: 10 firewall_log_limit_burst: 10
firewall_limit_ssh: true firewall_limit_ssh: true
firewall_limit_ssh_seconds: 60 firewall_limit_ssh_seconds: 600
firewall_limit_ssh_hitcount: 10 firewall_limit_ssh_hitcount: 10
firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}" firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"

17
roles/firewall/handlers/main.yaml
View File

@ -13,21 +13,18 @@
- name: ip6tables-restore - name: ip6tables-restore
command: ip6tables-restore {{ firewall_iptables_rules_v6 }} command: ip6tables-restore {{ firewall_iptables_rules_v6 }}
- name: reload ipset
shell: ipset restore -exist -file {{ firewall_ipset }}
- name: restart firewall v4 - name: restart firewall v4
command: "{{ item }}" shell: "{{ item }}"
loop: loop:
- iptables-restore /etc/iptables/clear.v4 - iptables-restore --test {{ firewall_iptables_rules_v4 }} && iptables-restore {{ firewall_iptables_rules_v4 }}
- ipset restore -file {{ firewall_ipset_v4 }}
- iptables-restore --test {{ firewall_iptables_rules_v4 }}
- iptables-restore {{ firewall_iptables_rules_v4 }}
- name: restart firewall v6 - name: restart firewall v6
command: "{{ item }}" shell: "{{ item }}"
loop: loop:
- ip6tables-restore /etc/iptables/clear.v6 - ip6tables-restore --test {{ firewall_iptables_rules_v6 }} && ip6tables-restore {{ firewall_iptables_rules_v6 }}
- ipset restore -file {{ firewall_ipset_v6 }}
- ip6tables-restore --test {{ firewall_iptables_rules_v6 }}
- ip6tables-restore {{ firewall_iptables_rules_v6 }}
- name: iptables-persistent - name: iptables-persistent
command: /usr/sbin/netfilter-persistent save command: /usr/sbin/netfilter-persistent save

19
roles/firewall/tasks/main.yaml
View File

@ -63,15 +63,15 @@
- clear.v4 - clear.v4
- clear.v6 - clear.v6
- name: configure IPv4 ipsets - name: configure ipsets
template: template:
src: ipset.v4.j2 src: ipset.j2
dest: "{{ firewall_ipset_v4 }}" dest: "{{ firewall_ipset }}"
owner: root owner: root
group: root group: root
mode: 0600 mode: 0600
notify: notify:
- restart firewall v4 - reload ipset
- iptables-persistent - iptables-persistent
- name: configure IPv4 firewall - name: configure IPv4 firewall
@ -85,17 +85,6 @@
- restart firewall v4 - restart firewall v4
- iptables-persistent - iptables-persistent
- name: configure IPv6 ipsets
template:
src: ipset.v6.j2
dest: "{{ firewall_ipset_v6 }}"
owner: root
group: root
mode: 0600
notify:
- restart firewall v6
- iptables-persistent
- name: configure IPv6 firewall - name: configure IPv6 firewall
template: template:
src: ip6tables.j2 src: ip6tables.j2

81
roles/firewall/templates/ip6tables.j2
View File

@ -23,16 +23,31 @@
-A LOG_DROP -p udp -m udp -m comment --comment "drop udp6" -j DROP -A LOG_DROP -p udp -m udp -m comment --comment "drop udp6" -j DROP
-A LOG_DROP -m comment --comment "reject all inet6" -j REJECT --reject-with icmp6-adm-prohibited -A LOG_DROP -m comment --comment "reject all inet6" -j REJECT --reject-with icmp6-adm-prohibited
{% if "wireguard" in ansible_play_role_names %}
{% for name, conf in wireguard_interfaces.items() %}
-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
{% endfor %}
{% for name, conf in wireguard_iptables.items() %}
{% if "input" in conf and conf.input %}
-A INPUT -i {{ name }} -j LOG_ACCEPT
{% endif %}
{% if "dns" in conf and conf.dns %}
-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
{% endif %}
{% endfor %}
{% endif %}
{% if firewall_limit_ssh %} {% if firewall_limit_ssh %}
-N LIMIT_SSH -N LIMIT_SSH
-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset -A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
-A LIMIT_SSH -m recent --set --name SSH --rsource -A LIMIT_SSH -m recent --set --name SSH --rsource
{% if firewall_use_ulogd %} {% if firewall_use_ulogd %}
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] " -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
{% else %} {% else %}
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
{% endif %} {% endif %}
-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v6 src -A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff6 src
-A LIMIT_SSH -j ACCEPT -A LIMIT_SSH -j ACCEPT
{% endif %} {% endif %}
@ -48,16 +63,6 @@
-A ICMP_FLOOD -j ACCEPT -A ICMP_FLOOD -j ACCEPT
{% endif %} {% endif %}
{% if firewall_dns_whitelist is defined and
firewall_dns_whitelist | length %}
-N ACCEPT_DNS
{% for ip in firewall_dns_whitelist | ipv6 %}
-A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT
-A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT
{% endfor %}
-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
{% endif %}
-A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
{% if firewall_ssh_whitelist | length %} {% if firewall_ssh_whitelist | length %}
@ -67,21 +72,13 @@
{% endif %} {% endif %}
{% if firewall_ipset_mgmt | length %} {% if firewall_ipset_mgmt | length %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
{% endif %}
{% if firewall_dns_whitelist is defined and
firewall_dns_whitelist | length %}
-A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS
-A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
{% endif %} {% endif %}
-A INPUT -m set --match-set block6 src -m comment --comment "drop block6" -j LOG_DROP
-A INPUT -m set --match-set gray6 src -m comment --comment "drop gray6" -j LOG_DROP
-A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
{% if firewall_ipset_blacklist | length %}
-A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
{% endif %}
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmpv6 130" -j ACCEPT -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmpv6 130" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmpv6 131" -j ACCEPT -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmpv6 131" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmpv6 132" -j ACCEPT -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmpv6 132" -j ACCEPT
@ -113,7 +110,7 @@
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT
{% if firewall_ipset_bogons | length %} {% if firewall_ipset_bogons | length %}
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
{% endif %} {% endif %}
{% if firewall_limit_ssh %} {% if firewall_limit_ssh %}
@ -122,6 +119,32 @@
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
{% endif %} {% endif %}
{% if firewall_ipset_node_exporter is defined %}
-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter6 src -m comment --comment "accept node_exporter 9100/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_blackbox_exporter is defined %}
-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter6 src -m comment --comment "accept blackbox_exporter 9115/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_mtail is defined %}
-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail6 src -m comment --comment "accept mtail 3903/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_syslog is defined %}
-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog6 src -m comment --comment "accept syslog 514/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_influxdb is defined %}
-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb6 src -m comment --comment "accept influxdb 8086/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_dns is defined %}
-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/tcp6" -j LOG_ACCEPT
-A INPUT -p udp -m udp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/udp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_loki is defined %}
-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki6 src -m comment --comment "accept loki 3100/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_promtail is defined %}
-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail6 src -m comment --comment "accept promtail 9080/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_allowed_tcp_ports | length %} {% if firewall_allowed_tcp_ports | length %}
{% for port in firewall_allowed_tcp_ports %} {% for port in firewall_allowed_tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
@ -152,7 +175,15 @@
-A INPUT -m comment --comment "default drop inet6" -j LOG_DROP -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP
-A FORWARD -m comment --comment "default forward drop inet6" -j LOG_DROP {% if "wireguard" in ansible_play_role_names %}
{% for name, conf in wireguard_iptables.items() %}
{% if "forward" in conf and conf.forward %}
-A FORWARD -i {{ name }} -o eth0 -j ACCEPT
{% endif %}
{% endfor %}
{% endif %}
-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
-A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT -A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT
COMMIT COMMIT

48
roles/firewall/templates/ipset.j2 Normal file
View File

@ -0,0 +1,48 @@
{% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
flush {{ name }}
{% if ipset is iterable %}
{% for ip_or_net in ipset %}
add {{ name }} {{ ip_or_net }}
{% endfor %}
{% endif %}
{% endmacro %}
{% macro render_dual_stack_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
{{ render_ipset(ipset | ipv4, name + "4", type=type, family=family, timeout=timeout) }}
{{ render_ipset(ipset | ipv6, name + "6", type=type, family="inet6", timeout=timeout) }}
{% endmacro %}
{{ render_dual_stack_ipset([], 'block') }}
{{ render_dual_stack_ipset([], 'gray', type="hash:ip", timeout=600) }}
{{ render_dual_stack_ipset([], 'cooloff', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
{% if firewall_ipset_mgmt is defined %}
{{ render_dual_stack_ipset(firewall_ipset_mgmt, 'mgmt') }}
{% endif %}
{% if firewall_ipset_bogons is defined %}
{{ render_dual_stack_ipset(firewall_ipset_bogons, 'bogons') }}
{% endif %}
{% if firewall_ipset_node_exporter is defined %}
{{ render_dual_stack_ipset(firewall_ipset_node_exporter, 'node_exporter') }}
{% endif %}
{% if firewall_ipset_blackbox_exporter is defined %}
{{ render_dual_stack_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter') }}
{% endif %}
{% if firewall_ipset_mtail is defined %}
{{ render_dual_stack_ipset(firewall_ipset_mtail, 'mtail') }}
{% endif %}
{% if firewall_ipset_syslog is defined %}
{{ render_dual_stack_ipset(firewall_ipset_syslog, 'syslog') }}
{% endif %}
{% if firewall_ipset_influxdb is defined %}
{{ render_dual_stack_ipset(firewall_ipset_influxdb, 'influxdb') }}
{% endif %}
{% if firewall_ipset_dns is defined %}
{{ render_dual_stack_ipset(firewall_ipset_dns, 'dns') }}
{% endif %}
{% if firewall_ipset_loki is defined %}
{{ render_dual_stack_ipset(firewall_ipset_loki, 'loki') }}
{% endif %}
{% if firewall_ipset_promtail is defined %}
{{ render_dual_stack_ipset(firewall_ipset_promtail, 'promtail') }}
{% endif %}

28
roles/firewall/templates/ipset.v4.j2
View File

@ -8,10 +8,30 @@ add {{ name }} {{ ip_or_net }}
{% endif %} {% endif %}
{% endmacro %} {% endmacro %}
{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }} {{ render_ipset(firewall_ipset_mgmt, 'mgmt4') }}
{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }} {{ render_ipset([], 'blacklist4') }}
{{ render_ipset([], 'graylist4', type="hash:ip", timeout=600) }}
{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }} {{ render_ipset(firewall_ipset_bogons, 'bogons4') }}
{{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} {{ render_ipset([], 'cooloff4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
{% if firewall_ipset_node_exporter is defined %}
{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter4') }}
{% endif %}
{% if firewall_ipset_blackbox_exporter is defined %}
{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter4') }}
{% endif %}
{% if firewall_ipset_mtail is defined %}
{{ render_ipset(firewall_ipset_mtail, 'mtail4') }}
{% endif %}
{% if firewall_ipset_syslog is defined %}
{{ render_ipset(firewall_ipset_syslog, 'syslog4') }}
{% endif %}
{% if firewall_ipset_influxdb is defined %}
{{ render_ipset(firewall_ipset_influxdb, 'influxdb4') }}
{% endif %}
{% if firewall_ipset_dns is defined %}
{{ render_ipset(firewall_ipset_dns, 'dns4') }}
{% endif %}

28
roles/firewall/templates/ipset.v6.j2
View File

@ -8,10 +8,30 @@ add {{ name }} {{ ip_or_net }}
{% endif %} {% endif %}
{% endmacro %} {% endmacro %}
{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }} {{ render_ipset(firewall_ipset_mgmt, 'mgmt6') }}
{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }} {{ render_ipset([], 'blacklist6') }}
{{ render_ipset([], 'graylist6', type="hash:ip", timeout=600) }}
{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }} {{ render_ipset(firewall_ipset_bogons, 'bogons6') }}
{{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }} {{ render_ipset([], 'cooloff6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
{% if firewall_ipset_node_exporter is defined %}
{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter6') }}
{% endif %}
{% if firewall_ipset_blackbox_exporter is defined %}
{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter6') }}
{% endif %}
{% if firewall_ipset_mtail is defined %}
{{ render_ipset(firewall_ipset_mtail, 'mtail6') }}
{% endif %}
{% if firewall_ipset_syslog is defined %}
{{ render_ipset(firewall_ipset_syslog, 'syslog6') }}
{% endif %}
{% if firewall_ipset_influxdb is defined %}
{{ render_ipset(firewall_ipset_influxdb, 'influxdb6') }}
{% endif %}
{% if firewall_ipset_dns is defined %}
{{ render_ipset(firewall_ipset_dns, 'dns6') }}
{% endif %}

122
roles/firewall/templates/iptables.j2
View File

@ -23,16 +23,31 @@
-A LOG_DROP -p udp -m udp -m comment --comment "drop udp" -j DROP -A LOG_DROP -p udp -m udp -m comment --comment "drop udp" -j DROP
-A LOG_DROP -m comment --comment "reject all" -j REJECT --reject-with icmp-admin-prohibited -A LOG_DROP -m comment --comment "reject all" -j REJECT --reject-with icmp-admin-prohibited
{% if "wireguard" in ansible_play_role_names %}
{% for name, conf in wireguard_interfaces.items() %}
-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
{% endfor %}
{% for name, conf in wireguard_iptables.items() %}
{% if "input" in conf and conf.input %}
-A INPUT -i {{ name }} -j LOG_ACCEPT
{% endif %}
{% if "dns" in conf and conf.dns %}
-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
{% endif %}
{% endfor %}
{% endif %}
{% if firewall_limit_ssh %} {% if firewall_limit_ssh %}
-N LIMIT_SSH -N LIMIT_SSH
-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset -A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
-A LIMIT_SSH -m recent --set --name SSH --rsource -A LIMIT_SSH -m recent --set --name SSH --rsource
{% if firewall_use_ulogd %} {% if firewall_use_ulogd %}
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] " -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
{% else %} {% else %}
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
{% endif %} {% endif %}
-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v4 src -A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff4 src
-A LIMIT_SSH -j ACCEPT -A LIMIT_SSH -j ACCEPT
{% endif %} {% endif %}
@ -48,34 +63,6 @@
-A ICMP_FLOOD -j ACCEPT -A ICMP_FLOOD -j ACCEPT
{% endif %} {% endif %}
{% if firewall_dns_whitelist is defined and
firewall_dns_whitelist | length %}
-N ACCEPT_DNS
{% for ip in firewall_dns_whitelist | ipv4 %}
-A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT
-A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT
{% endfor %}
-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
{% endif %}
{% if firewall_influx_whitelist is defined and
firewall_influx_whitelist | length %}
-N ACCEPT_INFLUX
{% for ip in firewall_influx_whitelist | ipv4 %}
-A ACCEPT_INFLUX -m tcp -p tcp --dport 8086 --source {{ ip }} -m comment --comment "accept {{ ip }} influxdb 8086/tcp" -j LOG_ACCEPT
{% endfor %}
-A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP
{% endif %}
{% if firewall_syslog_whitelist is defined and
firewall_syslog_whitelist | length %}
-N ACCEPT_SYSLOG
{% for ip in firewall_syslog_whitelist | ipv4 %}
-A ACCEPT_SYSLOG -m tcp -p tcp --dport 514 --source {{ ip }} -m comment --comment "accept {{ ip }} syslog 514/tcp" -j LOG_ACCEPT
{% endfor %}
-A ACCEPT_SYSLOG -m comment --comment "ACCEPT_SYSLOG default drop" -j LOG_DROP
{% endif %}
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
{% if firewall_ssh_whitelist | length %} {% if firewall_ssh_whitelist | length %}
@ -85,33 +72,15 @@
{% endif %} {% endif %}
{% if firewall_ipset_mgmt | length %} {% if firewall_ipset_mgmt | length %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
{% endif %}
{% if firewall_dns_whitelist is defined and
firewall_dns_whitelist | length %}
-A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS
-A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
{% endif %}
{% if firewall_influx_whitelist is defined and
firewall_influx_whitelist | length %}
-A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX
{% endif %}
{% if firewall_syslog_whitelist is defined and
firewall_syslog_whitelist | length %}
-A INPUT -m tcp -p tcp --dport 514 -m comment --comment "accept syslog 514/tcp" -j ACCEPT_SYSLOG
{% endif %} {% endif %}
-A INPUT -m set --match-set block4 src -m comment --comment "drop block4" -j LOG_DROP
-A INPUT -m set --match-set gray4 src -m comment --comment "drop gray4" -j LOG_DROP
-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
{% if firewall_ipset_blacklist | length %}
-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
{% endif %}
{% if firewall_ipset_bogons | length %} {% if firewall_ipset_bogons | length %}
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
{% endif %} {% endif %}
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
@ -136,6 +105,33 @@
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
{% endif %} {% endif %}
{% if firewall_ipset_node_exporter is defined %}
-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter4 src -m comment --comment "accept node_exporter 9100/tcp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_blackbox_exporter is defined %}
-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter4 src -m comment --comment "accept blackbox_exporter 9115/tcp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_mtail is defined %}
-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail4 src -m comment --comment "accept mtail 3903/tcp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_syslog is defined %}
-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/tcp" -j LOG_ACCEPT
-A INPUT -p udp -m udp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/udp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_influxdb is defined %}
-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb4 src -m comment --comment "accept influxdb 8086/tcp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_dns is defined %}
-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/tcp" -j LOG_ACCEPT
-A INPUT -p udp -m udp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/udp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_loki is defined %}
-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki4 src -m comment --comment "accept loki 3100/tcp" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_promtail is defined %}
-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail4 src -m comment --comment "accept promtail 9080/tcp" -j LOG_ACCEPT
{% endif %}
{% if firewall_allowed_tcp_ports | length %} {% if firewall_allowed_tcp_ports | length %}
{% for port in firewall_allowed_tcp_ports %} {% for port in firewall_allowed_tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
@ -166,6 +162,14 @@
-A INPUT -m comment --comment "default drop" -j LOG_DROP -A INPUT -m comment --comment "default drop" -j LOG_DROP
{% if "wireguard" in ansible_play_role_names %}
{% for name, conf in wireguard_iptables.items() %}
{% if "forward" in conf and conf.forward %}
-A FORWARD -i {{ name }} -o eth0 -j ACCEPT
{% endif %}
{% endfor %}
{% endif %}
-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP -A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
-A OUTPUT -m comment --comment "default output accept" -j ACCEPT -A OUTPUT -m comment --comment "default output accept" -j ACCEPT
@ -180,4 +184,18 @@ COMMIT
{% endif %} {% endif %}
COMMIT COMMIT
*nat
:PREROUTING ACCEPT -
:INPUT ACCEPT -
:OUTPUT ACCEPT -
:POSTROUTING ACCEPT -
{% if "wireguard" in ansible_play_role_names %}
{% for name, conf in wireguard_iptables.items() %}
{% if "nat" in conf %}
-A POSTROUTING -o {{ conf.nat.out_iface }} -s {{ conf.nat.source }} -j MASQUERADE
{% endif %}
{% endfor %}
{% endif %}
COMMIT
# vim: tw=0 # vim: tw=0