|
| 1 | +#!/bin/bash -eux |
| 2 | +# iptables firewall ( https://github.com/ethpandaops/ansible-collection-general/tree/master/roles/firewall ) |
| 3 | +# |
| 4 | +# {{ ansible_managed }} |
| 5 | + |
| 6 | +# No spoofing. |
| 7 | +if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] |
| 8 | +then |
| 9 | +for filter in /proc/sys/net/ipv4/conf/*/rp_filter |
| 10 | +do |
| 11 | +echo 1 > $filter |
| 12 | +done |
| 13 | +fi |
| 14 | + |
| 15 | +# Completely reset the firewall by removing all rules and chains. |
| 16 | +iptables -P INPUT ACCEPT |
| 17 | +iptables -P FORWARD ACCEPT |
| 18 | +iptables -P OUTPUT ACCEPT |
| 19 | +iptables -t nat -F |
| 20 | +iptables -t mangle -F |
| 21 | +iptables -F |
| 22 | +iptables -X |
| 23 | + |
| 24 | +# Accept traffic from loopback interface (localhost). |
| 25 | +iptables -A INPUT -i lo -j ACCEPT |
| 26 | + |
| 27 | +# Forwarded ports. |
| 28 | +{# Add a rule for each forwarded port #} |
| 29 | +{% for forwarded_port in firewall_forwarded_tcp_ports %} |
| 30 | +iptables -t nat -I PREROUTING -p tcp --dport {{ forwarded_port.src }} -j REDIRECT --to-port {{ forwarded_port.dest }} |
| 31 | +iptables -t nat -I OUTPUT -p tcp -o lo --dport {{ forwarded_port.src }} -j REDIRECT --to-port {{ forwarded_port.dest }} |
| 32 | +{% endfor %} |
| 33 | +{% for forwarded_port in firewall_forwarded_udp_ports %} |
| 34 | +iptables -t nat -I PREROUTING -p udp --dport {{ forwarded_port.src }} -j REDIRECT --to-port {{ forwarded_port.dest }} |
| 35 | +iptables -t nat -I OUTPUT -p udp -o lo --dport {{ forwarded_port.src }} -j REDIRECT --to-port {{ forwarded_port.dest }} |
| 36 | +{% endfor %} |
| 37 | + |
| 38 | +# Open ports. |
| 39 | +{# Add a rule for each open port #} |
| 40 | +{% for port in firewall_allowed_tcp_ports %} |
| 41 | +iptables -A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT |
| 42 | +{% endfor %} |
| 43 | +{% for port in firewall_allowed_udp_ports %} |
| 44 | +iptables -A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT |
| 45 | +{% endfor %} |
| 46 | + |
| 47 | +# Accept icmp ping requests. |
| 48 | +iptables -A INPUT -p icmp -j ACCEPT |
| 49 | + |
| 50 | +# Allow NTP traffic for time synchronization. |
| 51 | +iptables -A OUTPUT -p udp --dport 123 -j ACCEPT |
| 52 | +iptables -A INPUT -p udp --sport 123 -j ACCEPT |
| 53 | + |
| 54 | +# Additional custom rules. |
| 55 | +{% for rule in firewall_additional_rules %} |
| 56 | +{{ rule }} |
| 57 | +{% endfor %} |
| 58 | + |
| 59 | +# Allow established connections: |
| 60 | +iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 61 | + |
| 62 | +# Log EVERYTHING (ONLY for Debug). |
| 63 | +# iptables -A INPUT -j LOG |
| 64 | + |
| 65 | +{% if firewall_log_dropped_packets %} |
| 66 | +# Log other incoming requests (all of which are dropped) at 15/minute max. |
| 67 | +iptables -A INPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix "Dropped by firewall: " |
| 68 | +{% endif %} |
| 69 | + |
| 70 | +# Drop all other traffic. |
| 71 | +iptables -A INPUT -j DROP |
| 72 | + |
| 73 | + |
| 74 | +# Configure IPv6 if ip6tables is present. |
| 75 | +if [ -x "$(which ip6tables 2>/dev/null)" ]; then |
| 76 | + |
| 77 | + # Remove all rules and chains. |
| 78 | + ip6tables -F |
| 79 | + ip6tables -X |
| 80 | + |
| 81 | + # Accept traffic from loopback interface (localhost). |
| 82 | + ip6tables -A INPUT -i lo -j ACCEPT |
| 83 | + |
| 84 | + # Open ports. |
| 85 | + {# Add a rule for each open port #} |
| 86 | + {% for port in firewall_allowed_tcp_ports %} |
| 87 | + ip6tables -A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT |
| 88 | + {% endfor %} |
| 89 | + {% for port in firewall_allowed_udp_ports %} |
| 90 | + ip6tables -A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT |
| 91 | + {% endfor %} |
| 92 | + |
| 93 | + # Accept icmp ping requests. |
| 94 | + ip6tables -A INPUT -p icmp -j ACCEPT |
| 95 | + |
| 96 | + # Allow NTP traffic for time synchronization. |
| 97 | + ip6tables -A OUTPUT -p udp --dport 123 -j ACCEPT |
| 98 | + ip6tables -A INPUT -p udp --sport 123 -j ACCEPT |
| 99 | + |
| 100 | + # Additional custom rules. |
| 101 | + {% for rule in firewall_ip6_additional_rules %} |
| 102 | + {{ rule }} |
| 103 | + {% endfor %} |
| 104 | + |
| 105 | + # Allow established connections: |
| 106 | + ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 107 | + |
| 108 | + # Log EVERYTHING (ONLY for Debug). |
| 109 | + # ip6tables -A INPUT -j LOG |
| 110 | + |
| 111 | + {% if firewall_log_dropped_packets %} |
| 112 | + # Log other incoming requests (all of which are dropped) at 15/minute max. |
| 113 | + ip6tables -A INPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix "Dropped by firewall: " |
| 114 | + {% endif %} |
| 115 | + |
| 116 | + # Drop all other traffic. |
| 117 | + ip6tables -A INPUT -j DROP |
| 118 | + |
| 119 | +fi |
| 120 | + |
| 121 | +# Restart docker daemon if it's available |
| 122 | +if systemctl is-active --quiet docker > /dev/null 2>&1; then |
| 123 | + systemctl restart docker |
| 124 | +fi |
0 commit comments