From 0927b798e5b8b07ded6fc5af931d72fbfc47151b Mon Sep 17 00:00:00 2001 From: OldTyT Date: Mon, 19 Aug 2024 10:24:18 +0000 Subject: [PATCH] fix: template custom firewall --- templates/custom.firewall-restore.j2 | 44 ++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 12 deletions(-) diff --git a/templates/custom.firewall-restore.j2 b/templates/custom.firewall-restore.j2 index 1b983b9..a91d261 100644 --- a/templates/custom.firewall-restore.j2 +++ b/templates/custom.firewall-restore.j2 @@ -17,16 +17,26 @@ iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input iptables -N DOCKER-USER iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input {% for port in whitelist_public_tcp_port %} -iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT +{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +{% endfor %} {% for port in whitelist_public_udp_port %} -iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT +{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +{% endfor %} -iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} -iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT +{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT +{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} {% for port in whitelist_public_tcp_port %} -iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ whitelist_public_tcp_port|join(',') }} -j DROP{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -j DROP +{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +{% endfor %} {% for port in whitelist_public_udp_port %} -iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ whitelist_public_udp_port|join(',') }} -j DROP{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -j DROP +{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +{% endfor %} # IPv6 @@ -40,13 +50,23 @@ ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input ip6tables -N DOCKER-USER ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input {% for port in whitelist_public_tcp_port %} -ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT +{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +{% endfor %} {% for port in whitelist_public_udp_port %} -ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT +{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +{% endfor %} -ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} -ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT +{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT +{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} {% for port in whitelist_public_tcp_port %} -ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ whitelist_public_tcp_port|join(',') }} -j DROP{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -j DROP +{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +{% endfor %} {% for port in whitelist_public_udp_port %} -ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ whitelist_public_udp_port|join(',') }} -j DROP{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -j DROP +{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +{% endfor %}