From efe50abb82b43c728bcfd4b976bd3a8eea4a02b8 Mon Sep 17 00:00:00 2001 From: OldTyT Date: Mon, 19 Aug 2024 10:05:26 +0000 Subject: [PATCH] fix: masimum iptables ports --- templates/custom.firewall-restore.j2 | 37 +++++++++++++++++++--------- 1 file changed, 25 insertions(+), 12 deletions(-) diff --git a/templates/custom.firewall-restore.j2 b/templates/custom.firewall-restore.j2 index c07b055..1b983b9 100644 --- a/templates/custom.firewall-restore.j2 +++ b/templates/custom.firewall-restore.j2 @@ -2,6 +2,7 @@ {{ ansible_managed | comment }} +{% set iptables_enemy = namespace(ipv4=1, ipv6=1) %} ipset restore -! < {{ whitelist_ipset_config_file }} # IPv4 @@ -10,16 +11,22 @@ iptables -N f2b-sshd iptables -A f2b-sshd -j RETURN iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd + iptables -N enemy_input iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input iptables -N DOCKER-USER iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input -iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT -iptables -I enemy_input 2 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT -iptables -I enemy_input 3 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT -iptables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT -iptables -I enemy_input 5 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -j DROP -iptables -I enemy_input 6 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -j DROP +{% for port in whitelist_public_tcp_port %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} +{% for port in whitelist_public_udp_port %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} + +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %} +{% for port in whitelist_public_tcp_port %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ whitelist_public_tcp_port|join(',') }} -j DROP{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} +{% for port in whitelist_public_udp_port %} +iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ whitelist_public_udp_port|join(',') }} -j DROP{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}{% endfor %} # IPv6 @@ -27,13 +34,19 @@ ip6tables -N f2b-sshd ip6tables -A f2b-sshd -j RETURN ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd + ip6tables -N enemy_input ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input ip6tables -N DOCKER-USER ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input -ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT -ip6tables -I enemy_input 2 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT -ip6tables -I enemy_input 3 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT -ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT -ip6tables -I enemy_input 5 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }} -j DROP -ip6tables -I enemy_input 6 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }} -j DROP +{% for port in whitelist_public_tcp_port %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} +{% for port in whitelist_public_udp_port %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} + +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %} +{% for port in whitelist_public_tcp_port %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ whitelist_public_tcp_port|join(',') }} -j DROP{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %} +{% for port in whitelist_public_udp_port %} +ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ whitelist_public_udp_port|join(',') }} -j DROP{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}{% endfor %}