Rewrite rules

defaults/main.yml

@@ -2,9 +2,58 @@
 iptables__state: install
 iptables__drop_by_default: false
 iptables__allow_output_ifaces: []
-iptables__v4_filter_prepend: null
-iptables__v4_filter_append: null
-iptables__v4_nat: null
-iptables__v6_filter_prepend: null
-iptables__v6_filter_append: null
-iptables__v6_nat: null
+iptables__ssh_port: 22
+iptables__ssh_ifaces: []
+
+#############
+# NAT table #
+#############
+
+iptables__nat_v4:  null
+iptables__nat_v6:  null
+iptables__nat_all: null
+
+################
+# Filter table #
+################
+
+iptables__filter_prepend0_v4:  null
+iptables__filter_prepend0_v6:  null
+iptables__filter_prepend0_all: null
+iptables__filter_prepend1_v4:  null
+iptables__filter_prepend1_v6:  null
+iptables__filter_prepend1_all: null
+iptables__filter_prepend2_v4:  null
+iptables__filter_prepend2_v6:  null
+iptables__filter_prepend2_all: null
+
+iptables__filter_append0_v4:   null
+iptables__filter_append0_v6:   null
+iptables__filter_append0_all:  null
+iptables__filter_append1_v4:   null
+iptables__filter_append1_v6:   null
+iptables__filter_append1_all:  null
+iptables__filter_append2_v4:   null
+iptables__filter_append2_v6:   null
+iptables__filter_append2_all:  null
+
+iptables__filter_ssh_before_v4:   null
+iptables__filter_ssh_before_v6:   null
+iptables__filter_ssh_before_all:  null
+iptables__filter_ssh_after_v4:    null
+iptables__filter_ssh_after_v6:    null
+iptables__filter_ssh_after_all:   null
+
+iptables__filter_loop_before_v4:  null
+iptables__filter_loop_before_v6:  null
+iptables__filter_loop_before_all: null
+iptables__filter_loop_after_v4:   null
+iptables__filter_loop_after_v6:   null
+iptables__filter_loop_after_all:  null
+
+iptables__filter_out_before_v4:   null
+iptables__filter_out_before_v6:   null
+iptables__filter_out_before_all:  null
+iptables__filter_out_after_v4:    null
+iptables__filter_out_after_v6:    null
+iptables__filter_out_after_all:   null

handlers/main.yml

@@ -1,6 +1,6 @@
 ---
-- name: Load iptables rules for IPv4
+- name: iptables | Load iptables rules for IPv4
   shell: 'cat {{ iptables__conf_ipv4 }} | iptables-restore'
 
-- name: Load iptables rules for IPv6
+- name: iptables | Load iptables rules for IPv6
   shell: 'cat {{ iptables__conf_ipv6 }} | ip6tables-restore'

meta/main.yml

@@ -5,20 +5,24 @@ dependencies: []
 galaxy_info:
   role_name: iptables
   author: Alex Kotov
-  description: Common configuration
+  description: iptables persistence
   license: MIT
   min_ansible_version: 2.8
 
   galaxy_tags:
     - iptables
+    - firewall
+    - networking
 
   platforms:
     - name: Debian
       versions:
         - stretch  # Debian 9 Stretch
         - buster   # Debian 10 Buster
+        - bullseye # Debian 11 Bullseye
     - name: Ubuntu
       versions:
         - xenial  # Ubuntu 16.04 LTS Xenial Xerus
         - bionic  # Ubuntu 18.04 LTS Bionic Beaver
         - focal   # Ubuntu 20.04 LTS Focal Fossa
+        - jammy   # Ubuntu 22.04 LTS Jammy Jellyfish

tasks/install.yml

@@ -12,19 +12,19 @@
     group: root
 
 - name: Install iptables rules for IPv4
+  notify: iptables | Load iptables rules for IPv4
   template:
     src: templates/rules.v4
     dest: '{{ iptables__conf_ipv4 }}'
     mode: 'u=rw,go=r'
     owner: root
     group: root
-  notify: Load iptables rules for IPv4
 
 - name: Install iptables rules for IPv6
+  notify: iptables | Load iptables rules for IPv6
   template:
     src: templates/rules.v6
     dest: '{{ iptables__conf_ipv6 }}'
     mode: 'u=rw,go=r'
     owner: root
     group: root
-  notify: Load iptables rules for IPv6

templates/rules.v4

@@ -1,35 +1,75 @@
-#####
+################################################################################
 *nat
-#####
+################################################################################
 
 :PREROUTING  ACCEPT [0:0]
 :INPUT       ACCEPT [0:0]
 :OUTPUT      ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 
-# Remove all rules from all chains,
-# delete all user-defined chains.
+# Remove all rules from all chains.
 -F
+# Delete all user-defined chains.
 -X
 
-{{ iptables__v4_nat }}
+{{ iptables__nat_v4 }}
+{{ iptables__nat_all }}
 
 COMMIT
 
-########
+
+
+################################################################################
 *filter
-########
+################################################################################
 
 :INPUT   {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT  {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 
-# Remove all rules from all chains,
-# delete all user-defined chains.
+# Remove all rules from all chains.
 -F
+# Delete all user-defined chains.
 -X
 
-{{ iptables__v4_filter_prepend }}
+##########
+# Custom #
+##########
+
+{{ iptables__filter_prepend0_v6 }}
+{{ iptables__filter_prepend0_all }}
+{{ iptables__filter_prepend1_v6 }}
+{{ iptables__filter_prepend1_all }}
+{{ iptables__filter_prepend2_v6 }}
+{{ iptables__filter_prepend2_all }}
+
+#######
+# SSH #
+#######
+
+{{ iptables__filter_ssh_before_v6 }}
+{{ iptables__filter_ssh_before_all }}
+
+# Allow incoming SSH.
+{% if iptables__ssh_ifaces %}
+{% for iface in iptables__ssh_ifaces %}
+-A INPUT  -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
+{% endfor %}
+{% else %}
+-A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
+{% endif %}
+
+{{ iptables__filter_ssh_after_v6 }}
+{{ iptables__filter_ssh_after_all }}
+
+############
+# Loopback #
+############
+
+{{ iptables__filter_loop_before_v6 }}
+{{ iptables__filter_loop_before_all }}
 
 # Allow all loopback (lo) traffic and reject anything
 # to localhost that does not originate from lo.
@@ -37,6 +77,16 @@ COMMIT
 -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
 -A OUTPUT  -o lo                -j ACCEPT
 
+{{ iptables__filter_loop_after_v6 }}
+{{ iptables__filter_loop_after_all }}
+
+############
+# Outgoing #
+############
+
+{{ iptables__filter_out_before_v6 }}
+{{ iptables__filter_out_before_all }}
+
 # Allow all outgoing traffic.
 {% if iptables__allow_output_ifaces %}
 {% for iface in iptables__allow_output_ifaces %}
@@ -48,6 +98,13 @@ COMMIT
 -A INPUT  -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 {% endif %}
 
+{{ iptables__filter_out_after_v6 }}
+{{ iptables__filter_out_after_all }}
+
+########
+# ICMP #
+########
+
 # Allow some important ICMP.
 -A INPUT  -p icmp --icmp-type echo-request         -j ACCEPT
 -A OUTPUT -p icmp --icmp-type echo-request         -j ACCEPT
@@ -62,10 +119,15 @@ COMMIT
 -A INPUT  -p icmp -j DROP
 -A OUTPUT -p icmp -j DROP
 
-# Allow incoming SSH.
--A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
--A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
+##########
+# Custom #
+##########
 
-{{ iptables__v4_filter_append }}
+{{ iptables__filter_append0_v6 }}
+{{ iptables__filter_append0_all }}
+{{ iptables__filter_append1_v6 }}
+{{ iptables__filter_append1_all }}
+{{ iptables__filter_append2_v6 }}
+{{ iptables__filter_append2_all }}
 
 COMMIT

templates/rules.v6

@@ -1,35 +1,75 @@
-#####
+################################################################################
 *nat
-#####
+################################################################################
 
 :PREROUTING  ACCEPT [0:0]
 :INPUT       ACCEPT [0:0]
 :OUTPUT      ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 
-# Remove all rules from all chains,
-# delete all user-defined chains.
+# Remove all rules from all chains.
 -F
+# Delete all user-defined chains.
 -X
 
-{{ iptables__v6_nat }}
+{{ iptables__nat_v6 }}
+{{ iptables__nat_all }}
 
 COMMIT
 
-########
+
+
+################################################################################
 *filter
-########
+################################################################################
 
 :INPUT   {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT  {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 
-# Remove all rules from all chains,
-# delete all user-defined chains.
+# Remove all rules from all chains.
 -F
+# Delete all user-defined chains.
 -X
 
-{{ iptables__v6_filter_prepend }}
+##########
+# Custom #
+##########
+
+{{ iptables__filter_prepend0_v4 }}
+{{ iptables__filter_prepend0_all }}
+{{ iptables__filter_prepend1_v4 }}
+{{ iptables__filter_prepend1_all }}
+{{ iptables__filter_prepend2_v4 }}
+{{ iptables__filter_prepend2_all }}
+
+#######
+# SSH #
+#######
+
+{{ iptables__filter_ssh_before_v4 }}
+{{ iptables__filter_ssh_before_all }}
+
+# Allow incoming SSH.
+{% if iptables__ssh_ifaces %}
+{% for iface in iptables__ssh_ifaces %}
+-A INPUT  -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
+{% endfor %}
+{% else %}
+-A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
+{% endif %}
+
+{{ iptables__filter_ssh_after_v4 }}
+{{ iptables__filter_ssh_after_all }}
+
+############
+# Loopback #
+############
+
+{{ iptables__filter_loop_before_v4 }}
+{{ iptables__filter_loop_before_all }}
 
 # Allow all loopback (lo) traffic and reject anything
 # to localhost that does not originate from lo.
@@ -37,6 +77,16 @@ COMMIT
 -A INPUT ! -i lo -s ::/128 -j REJECT
 -A OUTPUT  -o lo           -j ACCEPT
 
+{{ iptables__filter_loop_after_v4 }}
+{{ iptables__filter_loop_after_all }}
+
+############
+# Outgoing #
+############
+
+{{ iptables__filter_out_before_v4 }}
+{{ iptables__filter_out_before_all }}
+
 # Allow all outgoing traffic.
 {% if iptables__allow_output_ifaces %}
 {% for iface in iptables__allow_output_ifaces %}
@@ -48,6 +98,13 @@ COMMIT
 -A INPUT  -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 {% endif %}
 
+{{ iptables__filter_out_after_v4 }}
+{{ iptables__filter_out_after_all }}
+
+########
+# ICMP #
+########
+
 # Allow some important ICMP.
 -A INPUT  -p icmpv6 --icmpv6-type echo-request   -j ACCEPT
 -A OUTPUT -p icmpv6 --icmpv6-type echo-request   -j ACCEPT
@@ -73,10 +130,15 @@ COMMIT
 -A INPUT  -p icmpv6 -j DROP
 -A OUTPUT -p icmpv6 -j DROP
 
-# Allow incoming SSH.
--A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
--A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
+##########
+# Custom #
+##########
 
-{{ iptables__v6_filter_append }}
+{{ iptables__filter_append0_v4 }}
+{{ iptables__filter_append0_all }}
+{{ iptables__filter_append1_v4 }}
+{{ iptables__filter_append1_all }}
+{{ iptables__filter_append2_v4 }}
+{{ iptables__filter_append2_all }}
 
 COMMIT