Clean up ulogd.conf template

roles/firewall/defaults/main.yaml

@@ -39,10 +39,19 @@ firewall_ulogd_package_name: ulogd2
 firewall_ulogd_service_name: ulogd2.service
 firewall_ulogd_config_path: /etc/ulogd.conf
 firewall_ulogd_nflog_group: 1
-firewall_ulogd_syslog_facility: LOG_LOCAL0
-firewall_ulogd_syslog_level: LOG_INFO
 
-firewall_iptables_nflog_group: 2
+# debug(1), info(3), notice(5), error(7) or fatal(8) (default 5)
+firewall_ulogd_log_level: 3
+
+firewall_ulogd_packet_mode_enabled: yes
+firewall_ulogd_packet_mode_syslog_facility: LOG_LOCAL0
+firewall_ulogd_packet_mode_syslog_level: LOG_INFO
+
+firewall_ulogd_flow_mode_enabled: yes
+firewall_ulogd_flow_mode_syslog_facility: LOG_LOCAL1
+firewall_ulogd_flow_mode_syslog_level: LOG_INFO
+
+firewall_iptables_nflog_group: 1
 
 firewall_drop_icmp_flood: true
 firewall_limit_icmp_flood_seconds: 1
@@ -64,6 +73,8 @@ firewall_limit_ssh_hitcount: 10
 
 firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"
 
+firewall_ssh_whitelist: {}
+
 # ipset's
 firewall_ipset_cooloff_timeout: 600
 

roles/firewall/templates/ip6tables.j2

@@ -50,12 +50,18 @@
 
 -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
 
--A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
+{% if firewall_ssh_whitelist.v6 %}
+{% for ip in firewall_ssh_whitelist.v6 %}
+-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
+{% endfor %}
+{% endif %}
 
 {% if firewall_ipset_mgmt.v6 is defined %}
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
+-A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
+
 {% if firewall_ipset_blacklist.v6 is defined %}
 -A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
 {% endif %}

roles/firewall/templates/iptables.j2

@@ -50,12 +50,18 @@
 
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
--A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
+{% if firewall_ssh_whitelist.v4 %}
+{% for ip in firewall_ssh_whitelist.v4 %}
+-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
+{% endfor %}
+{% endif %}
 
 {% if firewall_ipset_mgmt.v4 is defined %}
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
 {% endif %}
 
+-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
+
 {% if firewall_ipset_blacklist.v4 is defined %}
 -A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
 {% endif %}

roles/firewall/templates/ulogd.conf.j2

@@ -1,10 +1,10 @@
 [global]
 
 # logfile for status messages
-#logfile="syslog"
+logfile="syslog"
 
 # loglevel: debug(1), info(3), notice(5), error(7) or fatal(8) (default 5)
-#loglevel=3
+loglevel={{ firewall_ulogd_loglevel | default(3) }}
 
 plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inppkt_NFLOG.so"
 plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFCT.so"
@@ -15,12 +15,31 @@ plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTFLOW.so"
 plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SYSLOG.so"
 plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_raw2packet_BASE.so"
 
-# this is a stack for logging packets to syslog after a collect via NFLOG
-stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,sys1:SYSLOG
+{% if firewall_ulogd_packet_mode_enabled %}
+stack=packet:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,syslog-packet:SYSLOG
+{% endif %}
+{% if firewall_ulogd_flow_mode_enabled %}
+stack=flow:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,syslog-flow:SYSLOG
+{% endif %}
 
-[log1]
-group={{ firewall_ulogd_nflog_group | default(0) }}
+{% if firewall_ulogd_packet_mode_enabled %}
+[packet]
+group={{ firewall_ulogd_nflog_group | default(1) }}
+{% endif %}
 
-[sys1]
-facility={{ firewall_ulogd_syslog_facility | default("LOG_LOCAL0") }}
-level={{ firewall_ulogd_syslog_level | default("LOG_INFO") }}
+{% if firewall_ulogd_flow_mode_enabled %}
+[flow]
+#group={{ firewall_ulogd_nflog_group | default(1) }}
+{% endif %}
+
+{% if firewall_ulogd_packet_mode_enabled %}
+[syslog-packet]
+facility={{ firewall_ulogd_packet_mode_syslog_facility | default("LOG_LOCAL0") }}
+level={{ firewall_ulogd_packet_mode_syslog_level | default("LOG_INFO") }}
+{% endif %}
+
+{% if firewall_ulogd_flow_mode_enabled %}
+[syslog-flow]
+facility={{ firewall_ulogd_flow_mode_syslog_facility | default("LOG_LOCAL1") }}
+level={{ firewall_ulogd_flow_mode_syslog_level | default("LOG_INFO") }}
+{% endif %}