ansible/custom-firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: change firewall rules

Browse Source
This commit is contained in:
OldTyT
2023-11-20 20:49:01 +00:00
parent 0313751604
commit 5f678cb201
1 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
templates/custom.firewall-restore.j2
View File

@@ -7,17 +7,25 @@ ipset restore -! < {{ whitelist_ipset_config_file }}
# IP4
iptables -N f2b-sshd
iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_public_port|join(',') }} -j ACCEPT
iptables -I INPUT 2 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I INPUT 3 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP
iptables -I INPUT 4 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
iptables -A f2b-sshd -j RETURN
iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
iptables -N enemy_input
iptables -A INPUT -j enemy_input
iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP
# IP6
ip6tables -N f2b-sshd
ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_public_port|join(',') }} -j ACCEPT
ip6tables -I INPUT 2 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I INPUT 3 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP
ip6tables -I INPUT 4 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
ip6tables -A f2b-sshd -j RETURN
ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
ip6tables -N enemy_input
ip6tables -A INPUT -j enemy_input
ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP