ansible/custom-firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: template custom firewall

Browse Source
This commit is contained in:
OldTyT
2024-08-19 10:24:18 +00:00
parent efe50abb82
commit 0927b798e5
1 changed files with 32 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
templates/custom.firewall-restore.j2
View File

@@ -17,16 +17,26 @@ iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
iptables -N DOCKER-USER
iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
{% for port in whitelist_public_tcp_port %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
{% endfor %}
{% for port in whitelist_public_udp_port %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
{% endfor %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
{% for port in whitelist_public_tcp_port %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ whitelist_public_tcp_port|join(',') }} -j DROP{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -j DROP
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
{% endfor %}
{% for port in whitelist_public_udp_port %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ whitelist_public_udp_port|join(',') }} -j DROP{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %}
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -j DROP
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
{% endfor %}
# IPv6
@@ -40,13 +50,23 @@ ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -N DOCKER-USER
ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
{% for port in whitelist_public_tcp_port %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
{% endfor %}
{% for port in whitelist_public_udp_port %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
{% endfor %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
{% for port in whitelist_public_tcp_port %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ whitelist_public_tcp_port|join(',') }} -j DROP{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -j DROP
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
{% endfor %}
{% for port in whitelist_public_udp_port %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ whitelist_public_udp_port|join(',') }} -j DROP{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %}
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -j DROP
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
{% endfor %}