141 lines
7.1 KiB
Django/Jinja
141 lines
7.1 KiB
Django/Jinja
*filter
|
|
:INPUT {{ firewall_iptables_input_policy }}
|
|
:FORWARD {{ firewall_iptables_forward_policy }}
|
|
:OUTPUT {{ firewall_iptables_output_policy }}
|
|
|
|
-N LOG_ACCEPT
|
|
-A LOG_ACCEPT -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
|
|
{% if firewall_use_ulogd %}
|
|
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables ACCEPT] "
|
|
{% else %}
|
|
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ACCEPT] " --log-level info
|
|
{% endif %}
|
|
-A LOG_ACCEPT -j ACCEPT
|
|
|
|
-N LOG_DROP
|
|
-A LOG_DROP -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
|
|
{% if firewall_use_ulogd %}
|
|
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables DROP] "
|
|
{% else %}
|
|
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables DROP] " --log-level info
|
|
{% endif %}
|
|
-A LOG_DROP -p tcp -m tcp -m comment --comment "reject tcp" -j REJECT --reject-with tcp-reset
|
|
-A LOG_DROP -p udp -m udp -m comment --comment "drop udp" -j DROP
|
|
-A LOG_DROP -m comment --comment "reject all" -j REJECT --reject-with icmp-admin-prohibited
|
|
|
|
{% if firewall_limit_ssh %}
|
|
-N LIMIT_SSH
|
|
-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
|
|
-A LIMIT_SSH -m recent --set --name SSH --rsource
|
|
{% if firewall_use_ulogd %}
|
|
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
|
|
{% else %}
|
|
-A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
|
|
{% endif %}
|
|
-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v4 src
|
|
-A LIMIT_SSH -j ACCEPT
|
|
{% endif %}
|
|
|
|
{% if firewall_drop_icmp_flood %}
|
|
-N ICMP_FLOOD
|
|
-A ICMP_FLOOD -m recent --set --name ICMP --rsource
|
|
{% if firewall_use_ulogd %}
|
|
-A ICMP_FLOOD -m recent --update --seconds {{ firewall_limit_icmp_flood_seconds }} --hitcount {{ firewall_limit_icmp_flood_hitcount }} --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables ICMP FLOOD] "
|
|
{% else %}
|
|
-A ICMP_FLOOD -m recent --update --seconds {{ firewall_limit_icmp_flood_seconds }} --hitcount {{ firewall_limit_icmp_flood_hitcount }} --name ICMP --rsource --rttl -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables ICMP FLOOD] " --log-level info
|
|
{% endif %}
|
|
-A ICMP_FLOOD -m recent --update --seconds {{ firewall_limit_icmp_flood_seconds }} --hitcount {{ firewall_limit_icmp_flood_hitcount }} --name ICMP --rsource --rttl -m comment --comment "drop icmp flood" -j REJECT --reject-with icmp-admin-prohibited
|
|
-A ICMP_FLOOD -j ACCEPT
|
|
{% endif %}
|
|
|
|
{% if firewall_dns_whitelist is defined %}
|
|
-N ACCEPT_DNS
|
|
-A ACCEPT_DNS -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j LOG_ACCEPT
|
|
-A ACCEPT_DNS -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j LOG_ACCEPT
|
|
-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
|
|
{% endif %}
|
|
|
|
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
|
|
|
|
{% if firewall_ssh_whitelist | length %}
|
|
{% for ip in firewall_ssh_whitelist | ipv4 %}
|
|
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if firewall_ipset_mgmt | length %}
|
|
-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
|
|
{% endif %}
|
|
|
|
{% if firewall_dns_whitelist is defined and
|
|
firewall_dns_whitelist | length %}
|
|
{% for ip in firewall_dns_whitelist | ipv4 %}
|
|
-A INPUT -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j ACCEPT_DNS
|
|
-A INPUT -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j ACCEPT_DNS
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
-A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
|
|
|
|
{% if firewall_ipset_blacklist | length %}
|
|
-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
|
|
{% endif %}
|
|
|
|
{% if firewall_ipset_bogons | length %}
|
|
-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
|
|
{% endif %}
|
|
|
|
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
|
|
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -m comment --comment "accept icmp time-exceeded" -j ACCEPT
|
|
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -m comment --comment "accept icmp parameter-problem" -j ACCEPT
|
|
{% if firewall_drop_icmp_flood %}
|
|
-A INPUT -p icmp -m icmp --icmp-type echo-request -m comment --comment "accept icmp echo-request" -j ICMP_FLOOD
|
|
{% else %}
|
|
-A INPUT -p icmp -m icmp --icmp-type echo-request -m comment --comment "accept icmp echo-request" -j ACCEPT
|
|
{% endif %}
|
|
-A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
|
|
|
|
{% if firewall_allowed_icmp_types | length %}
|
|
{% for type in firewall_allowed_icmp_types | ipv4 %}
|
|
-A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if firewall_limit_ssh %}
|
|
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j LIMIT_SSH
|
|
{% else %}
|
|
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
|
|
{% endif %}
|
|
|
|
{% if firewall_allowed_tcp_ports | length %}
|
|
{% for port in firewall_allowed_tcp_ports %}
|
|
-A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if firewall_allowed_udp_ports | length %}
|
|
{% for port in firewall_allowed_udp_ports %}
|
|
-A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
|
|
|
|
-A INPUT -m comment --comment "default drop" -j LOG_DROP
|
|
|
|
-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
|
|
|
|
-A OUTPUT -m comment --comment "default output accept" -j ACCEPT
|
|
COMMIT
|
|
|
|
*raw
|
|
:PREROUTING ACCEPT -
|
|
:OUTPUT ACCEPT -
|
|
{% if firewall_loopback_notrack %}
|
|
-A PREROUTING -i lo -j NOTRACK
|
|
-A OUTPUT -o lo -j NOTRACK
|
|
{% endif %}
|
|
COMMIT
|
|
|
|
# vim: tw=0
|