You've already forked custom-firewall
73 lines
3.2 KiB
Django/Jinja
73 lines
3.2 KiB
Django/Jinja
#!/bin/bash
|
|
|
|
{{ ansible_managed | comment }}
|
|
|
|
{% set iptables_enemy = namespace(ipv4=1, ipv6=1) %}
|
|
ipset restore -! < {{ whitelist_ipset_config_file }}
|
|
|
|
# IPv4
|
|
|
|
iptables -N f2b-sshd
|
|
iptables -A f2b-sshd -j RETURN
|
|
iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
|
|
|
|
|
|
iptables -N enemy_input
|
|
iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
|
|
iptables -N DOCKER-USER
|
|
iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
|
|
{% for port in whitelist_public_tcp_port %}
|
|
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
|
|
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
|
|
{% endfor %}
|
|
{% for port in whitelist_public_udp_port %}
|
|
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
|
|
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
|
|
{% endfor %}
|
|
|
|
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
|
|
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
|
|
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
|
|
{% for port in whitelist_public_tcp_port %}
|
|
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }} -j DROP
|
|
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
|
|
{% endfor %}
|
|
{% for port in whitelist_public_udp_port %}
|
|
iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }} -j DROP
|
|
{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
|
|
{% endfor %}
|
|
|
|
# IPv6
|
|
|
|
ip6tables -N f2b-sshd
|
|
ip6tables -A f2b-sshd -j RETURN
|
|
ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
|
|
|
|
|
|
ip6tables -N enemy_input
|
|
ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
|
|
ip6tables -N DOCKER-USER
|
|
ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
|
|
{% for port in whitelist_public_tcp_port %}
|
|
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
|
|
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
|
|
{% endfor %}
|
|
{% for port in whitelist_public_udp_port %}
|
|
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
|
|
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
|
|
{% endfor %}
|
|
|
|
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
|
|
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
|
|
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
|
|
{% for port in whitelist_public_tcp_port %}
|
|
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }} -j DROP
|
|
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
|
|
{% endfor %}
|
|
{% for port in whitelist_public_udp_port %}
|
|
ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }} -j DROP
|
|
{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
|
|
{% endfor %}
|