Add role for host based firewall
This commit is contained in:
58
roles/firewall/templates/14-ipset.j2
Executable file
58
roles/firewall/templates/14-ipset.j2
Executable file
@ -0,0 +1,58 @@
|
||||
#!/bin/sh
|
||||
|
||||
SAVE_PATH={{ firewall_ipset_save_path }}
|
||||
|
||||
set -e
|
||||
|
||||
rc=0
|
||||
|
||||
load_ipset()
|
||||
{
|
||||
if [ ! -f $SAVE_PATH ]; then
|
||||
echo "Warning: skipping, no set to load"
|
||||
else
|
||||
/sbin/ipset restore -exist < $SAVE_PATH 2> /dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
rc=1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
save_ipset()
|
||||
{
|
||||
touch $SAVE_PATH
|
||||
chmod 0640 $SAVE_PATH
|
||||
/sbin/ipset save > $SAVE_PATH
|
||||
if [ $? -ne 0 ]; then
|
||||
rc=1
|
||||
fi
|
||||
}
|
||||
|
||||
flush_ipset()
|
||||
{
|
||||
/sbin/ipset flush
|
||||
if [ $? -ne 0 ]; then
|
||||
rc=1
|
||||
fi
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start|restart|reload|force-reload)
|
||||
load_ipset
|
||||
;;
|
||||
save)
|
||||
save_ipset
|
||||
;;
|
||||
stop)
|
||||
echo "Automatic flushing disabled, use \"flush\" instead of \"stop\""
|
||||
;;
|
||||
flush)
|
||||
flush_ipset
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $rc
|
||||
93
roles/firewall/templates/ip6tables.j2
Normal file
93
roles/firewall/templates/ip6tables.j2
Normal file
@ -0,0 +1,93 @@
|
||||
*filter
|
||||
:INPUT {{ firewall_iptables_input_policy_v6 }}
|
||||
:FORWARD {{ firewall_iptables_forward_policy_v6 }}
|
||||
:OUTPUT {{ firewall_iptables_output_policy_v6 }}
|
||||
|
||||
:LIMIT -
|
||||
|
||||
:LOG_LIMIT -
|
||||
:LOG_ACCEPT -
|
||||
:LOG_DROP -
|
||||
|
||||
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ACCEPT] " --log-level info
|
||||
-A LOG_ACCEPT -j ACCEPT
|
||||
|
||||
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables DROP] " --log-level info
|
||||
-A LOG_DROP -j DROP
|
||||
|
||||
-A LOG_LIMIT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables LIMIT] " --log-level info
|
||||
-A LOG_LIMIT -j DROP
|
||||
|
||||
-A LIMIT -m state --state NEW -m recent --set
|
||||
-A LIMIT -m state --state NEW -m recent --update --seconds {{ firewall_limit_seconds }} --hitcount {{ firewall_limit_hitcount }} -j LOG_LIMIT
|
||||
-A LIMIT -j ACCEPT
|
||||
|
||||
{% if firewall_drop_icmp_flood %}
|
||||
-N ICMP_FLOOD
|
||||
-A ICMP_FLOOD -m recent --set --name ICMP --rsource
|
||||
-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ICMP FLOOD] " --log-level info
|
||||
-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
|
||||
-A ICMP_FLOOD -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
|
||||
|
||||
{% for ipset in firewall_ipset_mgmt.v6 | default([]) %}
|
||||
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for ipset in firewall_ipset_blacklist.v6 | default([]) %}
|
||||
-A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist" -j LOG_DROP
|
||||
{% endfor %}
|
||||
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmp 130" -j ACCEPT
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmp 131" -j ACCEPT
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmp 132" -j ACCEPT
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 143 -m comment --comment "accept icmp 143" -j ACCEPT
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 151 -m hl --hl-eq 1 -m comment --comment "accept icmp 151" -j ACCEPT
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 152 -m hl --hl-eq 1 -m comment --comment "accept icmp 152" -j ACCEPT
|
||||
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 153 -m hl --hl-eq 1 -m comment --comment "accept icmp 153" -j ACCEPT
|
||||
|
||||
-A INPUT -s fe80::/10 -p udp -m udp --sport 547 --dport 546 -m comment --comment "accept dhcpv6" -j ACCEPT
|
||||
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type packet-too-big -m comment --comment "accept icmp packet-too-big" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type time-exceeded -m comment --comment "accept icmp time-exceeded" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type parameter-problem -m comment --comment "accept icmp parameter-problem" -j ACCEPT
|
||||
{% if firewall_drop_icmp_flood %}
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -m comment --comment "accept icmpv6 echo-request" -j ICMP_FLOOD
|
||||
{% else %}
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -m comment --comment "accept icmpv6 echo-request" -j ACCEPT
|
||||
{% endif %}
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
|
||||
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -m comment --comment "accept icmp router-solicitation" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -m comment --comment "accept icmp router-advertisement" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -m comment --comment "accept icmp neighbour-solicitation" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -m comment --comment "accept icmp neighbour-advertisement" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -m comment --comment "accept icmp 141" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -m comment --comment "accept icmp 142" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmp 148" -j ACCEPT
|
||||
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmp 149" -j ACCEPT
|
||||
|
||||
{% for ipset in firewall_ipset_bogons | default([]) %}
|
||||
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons" -j LOG_DROP
|
||||
{% endfor %}
|
||||
|
||||
{% for port in firewall_allowed_tcp_ports.v6 | default([]) %}
|
||||
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for port in firewall_allowed_udp_ports.v4 | default([]) %}
|
||||
-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for port in firewall_limited_tcp_ports.v6 | default([]) %}
|
||||
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "limit {{ port }}/tcp" -j LIMIT
|
||||
{% endfor %}
|
||||
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
|
||||
|
||||
-A INPUT -m comment --comment "log drop" -j LOG_DROP
|
||||
|
||||
COMMIT
|
||||
13
roles/firewall/templates/ipset.v4.j2
Normal file
13
roles/firewall/templates/ipset.v4.j2
Normal file
@ -0,0 +1,13 @@
|
||||
{% macro render_ipset(ipset, name, type="hash:net", family="inet") %}
|
||||
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters -exist
|
||||
flush {{ name }}
|
||||
{% for ip_or_net in ipset | default([]) %}
|
||||
add {{ name }} {{ ip_or_net }}
|
||||
{% endfor %}
|
||||
{% endmacro %}
|
||||
|
||||
{{ render_ipset(firewall_ipset_mgmt.v4, 'mgmt_v4') }}
|
||||
|
||||
{{ render_ipset(firewall_ipset_blacklist.v4, 'blacklist_v4') }}
|
||||
|
||||
{{ render_ipset(firewall_ipset_bogons.v4, 'bogons_v4') }}
|
||||
13
roles/firewall/templates/ipset.v6.j2
Normal file
13
roles/firewall/templates/ipset.v6.j2
Normal file
@ -0,0 +1,13 @@
|
||||
{% macro render_ipset(ipset, name, type="hash:net", family="inet6") %}
|
||||
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters -exist
|
||||
flush {{ name }}
|
||||
{% for ip_or_net in ipset | default([]) %}
|
||||
add {{ name }} {{ ip_or_net }}
|
||||
{% endfor %}
|
||||
{% endmacro %}
|
||||
|
||||
{{ render_ipset(firewall_ipset_mgmt.v6, 'mgmt_v6') }}
|
||||
|
||||
{{ render_ipset(firewall_ipset_blacklist.v6, 'blacklist_v6') }}
|
||||
|
||||
{{ render_ipset(firewall_ipset_bogons.v6, 'bogons_v6') }}
|
||||
77
roles/firewall/templates/iptables.j2
Normal file
77
roles/firewall/templates/iptables.j2
Normal file
@ -0,0 +1,77 @@
|
||||
*filter
|
||||
:INPUT {{ firewall_iptables_input_policy }}
|
||||
:FORWARD {{ firewall_iptables_forward_policy }}
|
||||
:OUTPUT {{ firewall_iptables_output_policy }}
|
||||
|
||||
:LIMIT -
|
||||
|
||||
:LOG_LIMIT -
|
||||
:LOG_ACCEPT -
|
||||
:LOG_DROP -
|
||||
|
||||
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ACCEPT] " --log-level info
|
||||
-A LOG_ACCEPT -j ACCEPT
|
||||
|
||||
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables DROP] " --log-level info
|
||||
-A LOG_DROP -j DROP
|
||||
|
||||
-A LOG_LIMIT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables LIMIT] " --log-level info
|
||||
-A LOG_LIMIT -j DROP
|
||||
|
||||
-A LIMIT -m state --state NEW -m recent --set
|
||||
-A LIMIT -m state --state NEW -m recent --update --seconds {{ firewall_limit_seconds }} --hitcount {{ firewall_limit_hitcount }} -j LOG_LIMIT
|
||||
-A LIMIT -j ACCEPT
|
||||
|
||||
{% if firewall_drop_icmp_flood %}
|
||||
-N ICMP_FLOOD
|
||||
-A ICMP_FLOOD -m recent --set --name ICMP --rsource
|
||||
-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ICMP FLOOD] " --log-level info
|
||||
-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
|
||||
-A ICMP_FLOOD -j ACCEPT
|
||||
{% endif %}
|
||||
|
||||
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
|
||||
|
||||
{% for ipset in firewall_ipset_mgmt.v4 | default([]) %}
|
||||
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for ipset in firewall_ipset_blacklist.v4 | default([]) %}
|
||||
-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
|
||||
{% endfor %}
|
||||
|
||||
{% for ipset in firewall_ipset_bogons | default([]) %}
|
||||
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
|
||||
{% endfor %}
|
||||
|
||||
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
|
||||
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -m comment --comment "accept icmp time-exceeded" -j ACCEPT
|
||||
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -m comment --comment "accept icmp parameter-problem" -j ACCEPT
|
||||
{% if firewall_drop_icmp_flood %}
|
||||
-A INPUT -p icmp -m icmp --icmp-type echo-request -m comment --comment "accept icmp echo-request" -j ICMP_FLOOD
|
||||
{% else %}
|
||||
-A INPUT -p icmp -m icmp --icmp-type echo-request -m comment --comment "accept icmp echo-request" -j ACCEPT
|
||||
{% endif %}
|
||||
-A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
|
||||
|
||||
{% for type in firewall_allowed_icmp_types.v4 | default([]) %}
|
||||
-A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for port in firewall_allowed_tcp_ports.v4 | default([]) %}
|
||||
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for port in firewall_allowed_udp_ports.v4 | default([]) %}
|
||||
-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
|
||||
{% endfor %}
|
||||
|
||||
{% for port in firewall_limited_tcp_ports.v4 | default([]) %}
|
||||
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "limit {{ port }}/tcp" -j LIMIT
|
||||
{% endfor %}
|
||||
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
|
||||
|
||||
-A INPUT -m comment --comment "log drop" -j LOG_DROP
|
||||
|
||||
COMMIT
|
||||
Reference in New Issue
Block a user