From 66312d4a90153a489187794c3b1af303823cf9f2 Mon Sep 17 00:00:00 2001 From: Ryan Cavicchioni Date: Sun, 20 Sep 2020 22:41:51 -0500 Subject: [PATCH] Syslog firewall rules --- roles/firewall/templates/iptables.j2 | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2 index 24bbb72..745e8e7 100644 --- a/roles/firewall/templates/iptables.j2 +++ b/roles/firewall/templates/iptables.j2 @@ -67,6 +67,15 @@ -A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP {% endif %} +{% if firewall_syslog_whitelist is defined and + firewall_syslog_whitelist | length %} +-N ACCEPT_SYSLOG +{% for ip in firewall_syslog_whitelist | ipv4 %} +-A ACCEPT_SYSLOG -m tcp -p tcp --dport 514 --source {{ ip }} -m comment --comment "accept {{ ip }} syslog 514/tcp" -j LOG_ACCEPT +{% endfor %} +-A ACCEPT_SYSLOG -m comment --comment "ACCEPT_SYSLOG default drop" -j LOG_DROP +{% endif %} + -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT {% if firewall_ssh_whitelist | length %} @@ -90,6 +99,11 @@ -A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX {% endif %} +{% if firewall_syslog_whitelist is defined and + firewall_syslog_whitelist | length %} +-A INPUT -m tcp -p tcp --dport 514 -m comment --comment "accept syslog 514/tcp" -j ACCEPT_SYSLOG +{% endif %} + -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP {% if firewall_ipset_blacklist | length %}