ansible/custom-firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: added banlist ipset list

Browse Source
This commit is contained in:
ilya
2026-06-13 19:50:09 +03:00
parent 9ab5401782
commit 365cbfd8de
3 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
defaults/main.yml
+4
View File
@@ -1,4 +1,8 @@
--- ---
banlist_ip4_name: "banlist"
banlist_ip6_name: "banlist6"
banlist_ip4: []
banlist_ip6: []
whitelist_ip4: [] whitelist_ip4: []
whitelist_ip6: [] whitelist_ip6: []
whitelist_interface: "eth0" whitelist_interface: "eth0"
templates/custom.firewall-restore.j2
+14 -12
View File
@@ -14,12 +14,13 @@ iptables -N enemy_input
iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
iptables -N DOCKER-USER iptables -N DOCKER-USER
iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
iptables -I enemy_input 1 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 1 -m set --match-set {{ banlist_ip4_name }} src -j DROP
iptables -I enemy_input 2 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 2 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 3 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 3 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I enemy_input 4 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP iptables -I enemy_input 5 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP iptables -I enemy_input 6 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
iptables -I enemy_input 7 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
iptables -I enemy_input -p icmp --icmp-type echo-request -j DROP iptables -I enemy_input -p icmp --icmp-type echo-request -j DROP
@@ -33,11 +34,12 @@ ip6tables -N enemy_input
ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -N DOCKER-USER ip6tables -N DOCKER-USER
ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -I enemy_input 1 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 1 -m set --match-set {{ banlist_ip6_name }} src -j DROP
ip6tables -I enemy_input 2 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 2 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 3 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 3 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT ip6tables -I enemy_input 4 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP ip6tables -I enemy_input 5 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP ip6tables -I enemy_input 6 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
ip6tables -I enemy_input 7 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
ip6tables -I enemy_input -p icmpv6 --icmpv6-type echo-request -j DROP ip6tables -I enemy_input -p icmpv6 --icmpv6-type echo-request -j DROP
templates/ipset.j2
+8
View File
@@ -1,4 +1,12 @@
flush flush
create {{ banlist_ip4_name }} hash:net maxelem 65536
{% for ban_ip4 in banlist_ip4 %}
add {{ banlist_ip4_name }} {{ ban_ip4 }}
{% endfor %}
create {{ banlist_ip6_name }} hash:ip family inet6
{% for ban_ip6 in banlist_ip6 %}
add {{ banlist_ip6_name }} {{ ban_ip6 }}
{% endfor %}
create {{ whitelist_ip4_name }} hash:net maxelem 65536 create {{ whitelist_ip4_name }} hash:net maxelem 65536
{% for white_ip4 in whitelist_ip4 %} {% for white_ip4 in whitelist_ip4 %}
add {{ whitelist_ip4_name }} {{ white_ip4 }} add {{ whitelist_ip4_name }} {{ white_ip4 }}