From 63c737518be005729efdd41e211a9d79c3dfe369 Mon Sep 17 00:00:00 2001
From: Ryan Cavicchioni <ryan@cavi.cc>
Date: Sun, 20 Sep 2020 22:41:25 -0500
Subject: [PATCH] InfluxDB rules

---
 roles/firewall/templates/iptables.j2 | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2
index 1e49ea9..24bbb72 100644
--- a/roles/firewall/templates/iptables.j2
+++ b/roles/firewall/templates/iptables.j2
@@ -58,6 +58,15 @@
 -A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
 {% endif %}
 
+{% if firewall_influx_whitelist is defined and
+      firewall_influx_whitelist | length %}
+-N ACCEPT_INFLUX
+{% for ip in firewall_influx_whitelist | ipv4 %}
+-A ACCEPT_INFLUX -m tcp -p tcp --dport 8086 --source {{ ip }} -m comment --comment "accept {{ ip }} influxdb 8086/tcp" -j LOG_ACCEPT
+{% endfor %}
+-A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP
+{% endif %}
+
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -76,6 +85,11 @@
 -A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
 {% endif %}
 
+{% if firewall_influx_whitelist is defined and
+      firewall_influx_whitelist | length %}
+-A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX
+{% endif %}
+
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
 
 {% if firewall_ipset_blacklist | length %}