ansible/custom-firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: added open udp port

Browse Source
This commit is contained in:
OldTyT
2024-02-26 08:41:04 +00:00
parent 7a61213088
commit aaefba17fd
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
templates/custom.firewall-restore.j2
View File

@@ -14,10 +14,12 @@ iptables -N enemy_input
iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
iptables -N DOCKER-USER
iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP
iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 2 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 3 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I enemy_input 5 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -j DROP
iptables -I enemy_input 6 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -j DROP
# IPv6
@@ -29,7 +31,9 @@ ip6tables -N enemy_input
ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -N DOCKER-USER
ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -j DROP
ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 2 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
ip6tables -I enemy_input 3 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I enemy_input 5 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -j DROP
ip6tables -I enemy_input 6 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -j DROP