ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Syslog firewall rules

Browse Source
This commit is contained in:
Ryan Cavicchioni 2020-09-20 22:41:51 -05:00
parent 63c737518b
commit 66312d4a90
Signed by: ryanc
GPG Key ID: 877EEDAF9245103D
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
roles/firewall/templates/iptables.j2
View File

@ -67,6 +67,15 @@
-A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP -A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP
{% endif %} {% endif %}
{% if firewall_syslog_whitelist is defined and
firewall_syslog_whitelist | length %}
-N ACCEPT_SYSLOG
{% for ip in firewall_syslog_whitelist | ipv4 %}
-A ACCEPT_SYSLOG -m tcp -p tcp --dport 514 --source {{ ip }} -m comment --comment "accept {{ ip }} syslog 514/tcp" -j LOG_ACCEPT
{% endfor %}
-A ACCEPT_SYSLOG -m comment --comment "ACCEPT_SYSLOG default drop" -j LOG_DROP
{% endif %}
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
{% if firewall_ssh_whitelist | length %} {% if firewall_ssh_whitelist | length %}
@ -90,6 +99,11 @@
-A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX -A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX
{% endif %} {% endif %}
{% if firewall_syslog_whitelist is defined and
firewall_syslog_whitelist | length %}
-A INPUT -m tcp -p tcp --dport 514 -m comment --comment "accept syslog 514/tcp" -j ACCEPT_SYSLOG
{% endif %}
-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
{% if firewall_ipset_blacklist | length %} {% if firewall_ipset_blacklist | length %}