From 74610403c6b5edc5685a81ede6f9ce224cff92e0 Mon Sep 17 00:00:00 2001 From: OldTyT Date: Fri, 23 Feb 2024 17:15:44 +0000 Subject: [PATCH] chore: fixing docker rules --- templates/custom.firewall-restore.j2 | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/templates/custom.firewall-restore.j2 b/templates/custom.firewall-restore.j2 index 6396a18..27d8822 100644 --- a/templates/custom.firewall-restore.j2 +++ b/templates/custom.firewall-restore.j2 @@ -4,27 +4,29 @@ ipset restore -! < {{ whitelist_ipset_config_file }} -# IP4 +# IPv4 iptables -N f2b-sshd iptables -A f2b-sshd -j RETURN iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd iptables -N enemy_input -iptables -A INPUT -i {{ whitelist_interface }} -j enemy_input +iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input +iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP -# IP6 +# IPv6 ip6tables -N f2b-sshd ip6tables -A f2b-sshd -j RETURN ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd ip6tables -N enemy_input -ip6tables -A INPUT -i {{ whitelist_interface }} -j enemy_input +ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input +ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT