Add role for host based firewall

roles/firewall/defaults/main.yaml

@@ -0,0 +1,87 @@
+---
+firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp
+firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp
+
+firewall_ipset_v4: /etc/iptables/ipset.v4-tmp
+firewall_ipset_v6: /etc/iptables/ipset.v6-tmp
+
+firewall_iptables_persistent_package_name: iptables-persistent
+firewall_iptables_persistent_package_state: present
+
+firewall_iptables_persistent_service_state: started
+firewall_iptables_persistent_service_enabled: true
+
+firewall_iptables_persistent_plugin_path: /usr/share/netfilter-persistent/plugins.d
+firewall_ipset_save_path: /etc/iptables/ipset
+
+firewall_ipset_package_name: ipset
+firewall_ipset_package_state: present
+
+firewall_iptables_input_policy: DROP
+firewall_iptables_output_policy: ACCEPT
+firewall_iptables_forward_policy: DROP
+
+firewall_iptables_input_policy_v6: DROP
+firewall_iptables_output_policy_v6: ACCEPT
+firewall_iptables_forward_policy_v6: DROP
+
+firewall_drop_icmp_flood: true
+
+firewall_limited_tcp_ports: {}
+
+firewall_allowed_tcp_ports: {}
+firewall_allowed_udp_ports: {}
+
+firewall_log_limit: 3/min
+firewall_log_limit_burst: 10
+
+firewall_limit_seconds: 60
+firewall_limit_hitcount: 10
+
+firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"
+
+# ipset's
+firewall_ipset_blacklist: {}
+
+firewall_ipset_mgmt: {}
+
+firewall_ipset_bogons:
+  v4:
+    - 0.0.0.0/8
+    - 10.0.0.0/8
+    - 100.64.0.0/10
+    - 127.0.0.0/8
+    - 169.254.0.0/16
+    - 172.16.0.0/12
+    - 192.0.0.0/24
+    - 192.0.2.0/24
+    - 192.168.0.0/16
+    - 198.18.0.0/15
+    - 198.51.100.0/24
+    - 203.0.113.0/24
+    - 224.0.0.0/4
+    - 240.0.0.0/4
+  v6:
+    - ::/96
+    - ::/128
+    - ::1/128
+    - ::ffff:0.0.0.0/96
+    - ::224.0.0.0/100
+    - ::127.0.0.0/104
+    - ::0.0.0.0/104
+    - ::255.0.0.0/104
+    - 0000::/8
+    - 0200::/7
+    - 3ffe::/16
+    - 2001:db8::/32
+    - 2002:e000::/20
+    - 2002:7f00::/24
+    - 2002:0000::/24
+    - 2002:ff00::/24
+    - 2002:0a00::/24
+    - 2002:ac10::/28
+    - 2002:c0a8::/32
+    - fc00::/7
+    - fe80::/10
+    - fec0::/10
+    - ff00::/8

roles/firewall/files/clear.v4

@@ -0,0 +1,27 @@
+*security
+:INPUT ACCEPT -
+:FORWARD ACCEPT -
+:OUTPUT ACCEPT -
+COMMIT
+*raw
+:PREROUTING ACCEPT -
+:OUTPUT ACCEPT -
+COMMIT
+*nat
+:PREROUTING ACCEPT -
+:INPUT ACCEPT -
+:OUTPUT ACCEPT -
+:POSTROUTING ACCEPT -
+COMMIT
+*mangle
+:PREROUTING ACCEPT -
+:INPUT ACCEPT -
+:FORWARD ACCEPT -
+:OUTPUT ACCEPT -
+:POSTROUTING ACCEPT -
+COMMIT
+*filter
+:INPUT ACCEPT -
+:FORWARD ACCEPT -
+:OUTPUT ACCEPT -
+COMMIT

roles/firewall/files/clear.v6

@@ -0,0 +1,27 @@
+*security
+:INPUT ACCEPT -
+:FORWARD ACCEPT -
+:OUTPUT ACCEPT -
+COMMIT
+*raw
+:PREROUTING ACCEPT -
+:OUTPUT ACCEPT -
+COMMIT
+*nat
+:PREROUTING ACCEPT -
+:INPUT ACCEPT -
+:OUTPUT ACCEPT -
+:POSTROUTING ACCEPT -
+COMMIT
+*mangle
+:PREROUTING ACCEPT -
+:INPUT ACCEPT -
+:FORWARD ACCEPT -
+:OUTPUT ACCEPT -
+:POSTROUTING ACCEPT -
+COMMIT
+*filter
+:INPUT ACCEPT -
+:FORWARD ACCEPT -
+:OUTPUT ACCEPT -
+COMMIT

roles/firewall/handlers/main.yaml

@@ -0,0 +1,33 @@
+- name: ipset restore v4
+  command: ipset restore -file {{ firewall_ipset_v4 }}
+
+- name: ipset restore v6
+  command: ipset restore -file {{ firewall_ipset_v6 }}
+
+- name: iptables-restore
+  command: "{{ item }}"
+  loop:
+    - iptables-restore --test {{ firewall_iptables_rules_v4 }}
+    - iptables-restore {{ firewall_iptables_rules_v4 }}
+
+- name: ip6tables-restore
+  command: ip6tables-restore {{ firewall_iptables_rules_v6 }}
+
+- name: restart firewall v4
+  command: "{{ item }}"
+  loop:
+    - iptables-restore /etc/iptables/clear.v4
+    - ipset restore -file {{ firewall_ipset_v4 }}
+    - iptables-restore --test {{ firewall_iptables_rules_v4 }}
+    - iptables-restore {{ firewall_iptables_rules_v4 }}
+
+- name: restart firewall v6
+  command: "{{ item }}"
+  loop:
+    - ip6tables-restore /etc/iptables/clear.v6
+    - ipset restore -file {{ firewall_ipset_v6 }}
+    - ip6tables-restore --test {{ firewall_iptables_rules_v6 }}
+    - ip6tables-restore {{ firewall_iptables_rules_v6 }}
+
+- name: iptables-persistent
+  command: /usr/sbin/netfilter-persistent save

roles/firewall/tasks/main.yaml

@@ -0,0 +1,85 @@
+---
+- name: gather OS specific variables
+  include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yaml"
+    - "{{ ansible_distribution }}.yaml"
+    - "{{ ansible_os_family }}.yaml"
+
+- name: install iptables-persistent
+  package:
+    name: "{{ firewall_iptables_persistent_package_name }}"
+    state: "{{ firewall_iptables_persistent_package_state }}"
+
+- name: manage iptables-persistent service
+  service:
+    name: "{{ firewall_iptables_persistent_service_name }}"
+    state: "{{ firewall_iptables_persistent_service_state }}"
+    enabled: "{{ firewall_iptables_persistent_service_enabled }}"
+
+- name: install ipset
+  package:
+    name: "{{ firewall_ipset_package_name }}"
+    state: "{{ firewall_ipset_package_state }}"
+
+- name: patch iptables-persistent service for ipset
+  template:
+    src: 14-ipset.j2
+    dest: "{{ firewall_iptables_persistent_plugin_path }}/14-ipset"
+    owner: root
+    group: root
+    mode: 0755
+
+- name: configure iptables clear rules
+  copy:
+    src: "{{ item }}"
+    dest: /etc/iptables/{{ item }}
+  loop:
+    - clear.v4
+    - clear.v6
+
+- name: configure IPv4 ipsets
+  template:
+    src: ipset.v4.j2
+    dest: "{{ firewall_ipset_v4 }}"
+    owner: root
+    group: root
+    mode: 0600
+  notify:
+    - restart firewall v4
+    - iptables-persistent
+
+- name: configure IPv4 firewall
+  template:
+    src: iptables.j2
+    dest: "{{ firewall_iptables_rules_v4 }}"
+    owner: root
+    group: root
+    mode: 0600
+  notify:
+    - restart firewall v4
+    - iptables-persistent
+
+- name: configure IPv6 ipsets
+  template:
+    src: ipset.v6.j2
+    dest: "{{ firewall_ipset_v6 }}"
+    owner: root
+    group: root
+    mode: 0600
+  notify:
+    - restart firewall v6
+    - iptables-persistent
+
+- name: configure IPv6 firewall
+  template:
+    src: ip6tables.j2
+    dest: "{{ firewall_iptables_rules_v6 }}"
+    owner: root
+    group: root
+    mode: 0600
+  notify:
+    - restart firewall v6
+    - iptables-persistent
+
+# vim:ft=yaml.ansible:

roles/firewall/templates/14-ipset.j2

@@ -0,0 +1,58 @@
+#!/bin/sh
+
+SAVE_PATH={{ firewall_ipset_save_path }}
+
+set -e
+
+rc=0
+
+load_ipset()
+{
+	if [ ! -f $SAVE_PATH ]; then
+		echo "Warning: skipping, no set to load" 
+	else
+		/sbin/ipset restore -exist < $SAVE_PATH 2> /dev/null
+		if [ $? -ne 0 ]; then
+			rc=1
+		fi
+	fi
+}
+
+save_ipset()
+{
+    touch $SAVE_PATH
+    chmod 0640 $SAVE_PATH
+    /sbin/ipset save > $SAVE_PATH
+    if [ $? -ne 0 ]; then
+        rc=1
+    fi
+}
+
+flush_ipset()
+{
+    /sbin/ipset flush
+    if [ $? -ne 0 ]; then
+        rc=1
+    fi
+}
+
+case "$1" in
+start|restart|reload|force-reload)
+	load_ipset
+	;;
+save)
+	save_ipset
+	;;
+stop)
+	echo "Automatic flushing disabled, use \"flush\" instead of \"stop\""
+	;;
+flush)
+	flush_ipset
+	;;
+*)
+    echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
+    exit 1
+    ;;
+esac
+
+exit $rc

roles/firewall/templates/ip6tables.j2

@@ -0,0 +1,93 @@
+*filter
+:INPUT {{ firewall_iptables_input_policy_v6 }}
+:FORWARD {{ firewall_iptables_forward_policy_v6 }}
+:OUTPUT {{ firewall_iptables_output_policy_v6 }}
+
+:LIMIT -
+
+:LOG_LIMIT -
+:LOG_ACCEPT - 
+:LOG_DROP -
+
+-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ACCEPT] " --log-level info
+-A LOG_ACCEPT -j ACCEPT
+
+-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables DROP] " --log-level info
+-A LOG_DROP -j DROP
+
+-A LOG_LIMIT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables LIMIT] " --log-level info
+-A LOG_LIMIT -j DROP
+
+-A LIMIT -m state --state NEW -m recent --set
+-A LIMIT -m state --state NEW -m recent --update --seconds {{ firewall_limit_seconds }} --hitcount {{ firewall_limit_hitcount }} -j LOG_LIMIT
+-A LIMIT -j ACCEPT
+
+{% if firewall_drop_icmp_flood %}
+-N ICMP_FLOOD
+-A ICMP_FLOOD -m recent --set --name ICMP --rsource
+-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ICMP FLOOD] " --log-level info
+-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
+-A ICMP_FLOOD -j ACCEPT
+{% endif %}
+
+-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
+
+{% for ipset in firewall_ipset_mgmt.v6 | default([]) %}
+-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh" -j ACCEPT
+{% endfor %}
+
+{% for ipset in firewall_ipset_blacklist.v6 | default([]) %}
+-A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist" -j LOG_DROP
+{% endfor %}
+
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmp 130" -j ACCEPT
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmp 131" -j ACCEPT
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmp 132" -j ACCEPT
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 143 -m comment --comment "accept icmp 143" -j ACCEPT
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 151 -m hl --hl-eq 1 -m comment --comment "accept icmp 151" -j ACCEPT
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 152 -m hl --hl-eq 1 -m comment --comment "accept icmp 152" -j ACCEPT
+-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 153 -m hl --hl-eq 1 -m comment --comment "accept icmp 153" -j ACCEPT
+
+-A INPUT -s fe80::/10 -p udp -m udp --sport 547 --dport 546 -m comment --comment "accept dhcpv6" -j ACCEPT
+
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type packet-too-big -m comment --comment "accept icmp packet-too-big" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type time-exceeded -m comment --comment "accept icmp time-exceeded" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type parameter-problem -m comment --comment "accept icmp parameter-problem" -j ACCEPT
+{% if firewall_drop_icmp_flood %}
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -m comment --comment "accept icmpv6 echo-request" -j ICMP_FLOOD
+{% else %}
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -m comment --comment "accept icmpv6 echo-request" -j ACCEPT
+{% endif %}
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
+
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -m comment --comment "accept icmp router-solicitation" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -m comment --comment "accept icmp router-advertisement" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -m comment --comment "accept icmp neighbour-solicitation" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -m comment --comment "accept icmp neighbour-advertisement" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -m comment --comment "accept icmp 141" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -m comment --comment "accept icmp 142" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmp 148" -j ACCEPT
+-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmp 149" -j ACCEPT
+
+{% for ipset in firewall_ipset_bogons | default([]) %}
+-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons" -j LOG_DROP
+{% endfor %}
+
+{% for port in firewall_allowed_tcp_ports.v6 | default([]) %}
+-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
+{% endfor %}
+
+{% for port in firewall_allowed_udp_ports.v4 | default([]) %}
+-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
+{% endfor %}
+
+{% for port in firewall_limited_tcp_ports.v6 | default([]) %}
+-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "limit {{ port }}/tcp" -j LIMIT
+{% endfor %}
+
+-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
+
+-A INPUT -m comment --comment "log drop" -j LOG_DROP
+
+COMMIT

roles/firewall/templates/ipset.v4.j2

@@ -0,0 +1,13 @@
+{% macro render_ipset(ipset, name, type="hash:net", family="inet") %}
+create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters -exist
+flush {{ name }}
+{% for ip_or_net in ipset | default([]) %}
+add {{ name }} {{ ip_or_net }}
+{% endfor %}
+{% endmacro %}
+
+{{ render_ipset(firewall_ipset_mgmt.v4, 'mgmt_v4') }}
+
+{{ render_ipset(firewall_ipset_blacklist.v4, 'blacklist_v4') }}
+
+{{ render_ipset(firewall_ipset_bogons.v4, 'bogons_v4') }}

roles/firewall/templates/ipset.v6.j2

@@ -0,0 +1,13 @@
+{% macro render_ipset(ipset, name, type="hash:net", family="inet6") %}
+create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters -exist
+flush {{ name }}
+{% for ip_or_net in ipset | default([]) %}
+add {{ name }} {{ ip_or_net }}
+{% endfor %}
+{% endmacro %}
+
+{{ render_ipset(firewall_ipset_mgmt.v6, 'mgmt_v6') }}
+
+{{ render_ipset(firewall_ipset_blacklist.v6, 'blacklist_v6') }}
+
+{{ render_ipset(firewall_ipset_bogons.v6, 'bogons_v6') }}

roles/firewall/templates/iptables.j2

@@ -0,0 +1,77 @@
+*filter
+:INPUT {{ firewall_iptables_input_policy }}
+:FORWARD {{ firewall_iptables_forward_policy }}
+:OUTPUT {{ firewall_iptables_output_policy }}
+
+:LIMIT -
+
+:LOG_LIMIT -
+:LOG_ACCEPT - 
+:LOG_DROP -
+
+-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ACCEPT] " --log-level info
+-A LOG_ACCEPT -j ACCEPT
+
+-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables DROP] " --log-level info
+-A LOG_DROP -j DROP
+
+-A LOG_LIMIT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables LIMIT] " --log-level info
+-A LOG_LIMIT -j DROP
+
+-A LIMIT -m state --state NEW -m recent --set
+-A LIMIT -m state --state NEW -m recent --update --seconds {{ firewall_limit_seconds }} --hitcount {{ firewall_limit_hitcount }} -j LOG_LIMIT
+-A LIMIT -j ACCEPT
+
+{% if firewall_drop_icmp_flood %}
+-N ICMP_FLOOD
+-A ICMP_FLOOD -m recent --set --name ICMP --rsource
+-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ICMP FLOOD] " --log-level info
+-A ICMP_FLOOD -m recent --update --seconds 1 --hitcount 6 --name ICMP --rsource --rttl -j DROP
+-A ICMP_FLOOD -j ACCEPT
+{% endif %}
+
+-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
+
+{% for ipset in firewall_ipset_mgmt.v4 | default([]) %}
+-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh" -j ACCEPT
+{% endfor %}
+
+{% for ipset in firewall_ipset_blacklist.v4 | default([]) %}
+-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
+{% endfor %}
+
+{% for ipset in firewall_ipset_bogons | default([]) %}
+-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
+{% endfor %}
+
+-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
+-A INPUT -p icmp -m icmp --icmp-type time-exceeded -m comment --comment "accept icmp time-exceeded" -j ACCEPT
+-A INPUT -p icmp -m icmp --icmp-type parameter-problem -m comment --comment "accept icmp parameter-problem" -j ACCEPT
+{% if firewall_drop_icmp_flood %}
+-A INPUT -p icmp -m icmp --icmp-type echo-request -m comment --comment "accept icmp echo-request" -j ICMP_FLOOD
+{% else %}
+-A INPUT -p icmp -m icmp --icmp-type echo-request -m comment --comment "accept icmp echo-request" -j ACCEPT
+{% endif %}
+-A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
+
+{% for type in firewall_allowed_icmp_types.v4 | default([]) %}
+-A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
+{% endfor %}
+
+{% for port in firewall_allowed_tcp_ports.v4 | default([]) %}
+-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
+{% endfor %}
+
+{% for port in firewall_allowed_udp_ports.v4 | default([]) %}
+-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
+{% endfor %}
+
+{% for port in firewall_limited_tcp_ports.v4 | default([]) %}
+-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "limit {{ port }}/tcp" -j LIMIT
+{% endfor %}
+
+-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
+
+-A INPUT -m comment --comment "log drop" -j LOG_DROP
+
+COMMIT

roles/firewall/vars/Ubuntu.yaml

@@ -0,0 +1,2 @@
+---
+firewall_iptables_persistent_service_name: netfilter-persistent.service