ansible/custom-firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: added interface in enemy input

Browse Source
This commit is contained in:
OldTyT
2023-11-20 21:58:57 +00:00
parent 5f678cb201
commit dc576d183b
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
defaults/main.yml
View File

@@ -1,6 +1,7 @@
--- ---
whitelist_ip4: [] whitelist_ip4: []
whitelist_ip6: [] whitelist_ip6: []
whitelist_interface: "eth0"
whitelist_ip4_name: "whitelist" whitelist_ip4_name: "whitelist"
whitelist_ip6_name: "whitelist6" whitelist_ip6_name: "whitelist6"
whitelist_public_port: whitelist_public_port:

4
templates/custom.firewall-restore.j2
View File

@@ -11,7 +11,7 @@ iptables -A f2b-sshd -j RETURN
iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
iptables -N enemy_input iptables -N enemy_input
iptables -A INPUT -j enemy_input iptables -A INPUT -i {{ whitelist_interface }} -j enemy_input
iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
@@ -24,7 +24,7 @@ ip6tables -A f2b-sshd -j RETURN
ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
ip6tables -N enemy_input ip6tables -N enemy_input
ip6tables -A INPUT -j enemy_input ip6tables -A INPUT -i {{ whitelist_interface }} -j enemy_input
ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT