*filter
:INPUT {{ firewall_iptables_input_policy_v6 }}
:FORWARD {{ firewall_iptables_forward_policy_v6 }}
:OUTPUT {{ firewall_iptables_output_policy_v6 }}

-N LOG_ACCEPT
-A LOG_ACCEPT -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
{% if firewall_use_ulogd %}
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables ACCEPT] "
{% else %}
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ACCEPT] " --log-level info
{% endif %}
-A LOG_ACCEPT -j ACCEPT

-N LOG_DROP
-A LOG_DROP -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
{% if firewall_use_ulogd %}
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables DROP] "
{% else %}
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables DROP] " --log-level info
{% endif %}
-A LOG_DROP -p tcp -m tcp -m comment --comment "reject tcp6" -j REJECT --reject-with tcp-reset
-A LOG_DROP -p udp -m udp -m comment --comment "drop udp6" -j DROP
-A LOG_DROP -m comment --comment "reject all inet6" -j REJECT --reject-with icmp6-adm-prohibited

{% if "wireguard" in ansible_play_role_names %}
{%   for name, conf in wireguard_interfaces.items() %}
-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
{%   endfor %}
{%   for name, conf in wireguard_iptables.items() %}
{%     if "input" in conf and conf.input %}
-A INPUT -i {{ name }} -j LOG_ACCEPT
{%     endif %}
{%     if "dns" in conf and conf.dns %}
-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
{%     endif %}
{%   endfor %}
{% endif %}

{% if firewall_limit_ssh %}
-N LIMIT_SSH
-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
-A LIMIT_SSH -m recent --set --name SSH --rsource
{% if firewall_use_ulogd %}
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
{% else %}
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
{% endif %}
-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff6 src
-A LIMIT_SSH -j ACCEPT
{% endif %}

{% if firewall_drop_icmp_flood %}
-N ICMP_FLOOD
-A ICMP_FLOOD -m recent --set --name ICMP --rsource
{% if firewall_use_ulogd %}
-A ICMP_FLOOD -m recent --update --seconds {{ firewall_limit_icmp_flood_seconds }} --hitcount {{ firewall_limit_icmp_flood_hitcount }} --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables ICMP FLOOD] "
{% else %}
-A ICMP_FLOOD -m recent --update --seconds {{ firewall_limit_icmp_flood_seconds }} --hitcount {{ firewall_limit_icmp_flood_hitcount }} --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ICMP FLOOD] " --log-level info
{% endif %}
-A ICMP_FLOOD -m recent --update --seconds {{ firewall_limit_icmp_flood_seconds }} --hitcount {{ firewall_limit_icmp_flood_hitcount }} --name ICMP --rsource --rttl -m comment --comment "drop icmpv6 flood" -j REJECT --reject-with icmp6-adm-prohibited
-A ICMP_FLOOD -j ACCEPT
{% endif %}

-A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT

{% if firewall_ssh_whitelist | length %}
{% for ip in firewall_ssh_whitelist | ansible.utils.ipv6 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
{% endfor %}
{% endif %}

{% if firewall_ipset_mgmt | length %}
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
{% endif %}

-A INPUT -m set --match-set block6 src -m comment --comment "drop block6" -j LOG_DROP
-A INPUT -m set --match-set gray6 src -m comment --comment "drop gray6" -j LOG_DROP
-A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP

-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmpv6 130" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmpv6 131" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmpv6 132" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 143 -m comment --comment "accept icmpv6 143" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 151 -m hl --hl-eq 1 -m comment --comment "accept icmpv6 151" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 152 -m hl --hl-eq 1 -m comment --comment "accept icmpv6 152" -j ACCEPT
-A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 153 -m hl --hl-eq 1 -m comment --comment "accept icmpv6 153" -j ACCEPT

-A INPUT -s fe80::/10 -p udp -m udp --sport 547 --dport 546 -m comment --comment "accept dhcpv6" -j ACCEPT

-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type destination-unreachable -m comment --comment "accept icmpv6 destination-unreachable" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type packet-too-big -m comment --comment "accept icmpv6 packet-too-big" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type time-exceeded -m comment --comment "accept icmpv6 time-exceeded" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type parameter-problem -m comment --comment "accept icmpv6 parameter-problem" -j ACCEPT
{% if firewall_drop_icmp_flood %}
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -m comment --comment "accept icmpv6 echo-request" -j ICMP_FLOOD
{% else %}
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-request -m comment --comment "accept icmpv6 echo-request" -j ACCEPT
{% endif %}
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type echo-reply -m comment --comment "accept icmpv6 echo-reply" -j ACCEPT

-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -m comment --comment "accept icmpv6 router-solicitation" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -m comment --comment "accept icmpv6 router-advertisement" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -m comment --comment "accept icmpv6 neighbour-solicitation" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -m comment --comment "accept icmpv6 neighbour-advertisement" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 141" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 142" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 148" -j ACCEPT
-A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT

{% if firewall_ipset_bogons | length %}
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
{% endif %}

{% if firewall_limit_ssh %}
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j LIMIT_SSH
{% else %}
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
{% endif %}

{% if firewall_ipset_node_exporter is defined %}
-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter6 src -m comment --comment "accept node_exporter 9100/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_blackbox_exporter is defined %}
-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter6 src -m comment --comment "accept blackbox_exporter 9115/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_mtail is defined %}
-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail6 src -m comment --comment "accept mtail 3903/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_syslog is defined %}
-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog6 src -m comment --comment "accept syslog 514/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_influxdb is defined %}
-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb6 src -m comment --comment "accept influxdb 8086/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_dns is defined %}
-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/tcp6" -j LOG_ACCEPT
-A INPUT -p udp -m udp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/udp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_loki is defined %}
-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki6 src -m comment --comment "accept loki 3100/tcp6" -j LOG_ACCEPT
{% endif %}
{% if firewall_ipset_promtail is defined %}
-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail6 src -m comment --comment "accept promtail 9080/tcp6" -j LOG_ACCEPT
{% endif %}

{% if firewall_allowed_tcp_ports | length %}
{% for port in firewall_allowed_tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
{% endfor %}
{% endif %}

{% if firewall_allowed_udp_ports | length %}
{% for port in firewall_allowed_udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp6" -j ACCEPT
{% endfor %}
{% endif %}

{% if firewall_teleport_node_enabled | default(false) %}
-A INPUT -p tcp -m tcp --dport 3022 -m state --state NEW -m comment --comment "accept 3022/tcp" -j ACCEPT
{% endif %}

{% if firewall_teleport_proxy_enabled | default(false) %}
-A INPUT -p tcp -m tcp --dport 3023 -m state --state NEW -m comment --comment "accept 3023/tcp" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3024 -m state --state NEW -m comment --comment "accept 3024/tcp" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3080 -m state --state NEW -m comment --comment "accept 3080/tcp" -j ACCEPT
{% endif %}

{% if firewall_teleport_auth_enabled | default(false) %}
-A INPUT -p tcp -m tcp --dport 3025 -m state --state NEW -m comment --comment "accept 3025/tcp" -j ACCEPT
{% endif %}

-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT

-A INPUT -m comment --comment "default drop inet6" -j LOG_DROP

{% if "wireguard" in ansible_play_role_names %}
{%   for name, conf in wireguard_iptables.items() %}
{%     if "forward" in conf and conf.forward %}
-A FORWARD -i {{ name }} -o eth0 -j ACCEPT
{%      endif %}
{%   endfor %}
{% endif %}
-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP

-A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT
COMMIT

*raw
:PREROUTING ACCEPT -
:OUTPUT ACCEPT -
{% if firewall_loopback_notrack %}
-A PREROUTING -i lo -j NOTRACK
-A OUTPUT -o lo -j NOTRACK
{% endif %}
COMMIT
# vim: tw=0