Compare commits
9 Commits
Author | SHA1 | Date |
---|---|---|
Alex Kotov | 932223211e | |
Alex Kotov | f4fc8adf7b | |
Alex Kotov | 21de434815 | |
Alex Kotov | 0d8aac958d | |
Alex Kotov | 996800a848 | |
Alex Kotov | 8a0c3463c1 | |
Alex Kotov | 8f22bec689 | |
Alex Kotov | 77ec14c284 | |
Alex Kotov | 45a9ad69f1 |
|
@ -2,9 +2,58 @@
|
||||||
iptables__state: install
|
iptables__state: install
|
||||||
iptables__drop_by_default: false
|
iptables__drop_by_default: false
|
||||||
iptables__allow_output_ifaces: []
|
iptables__allow_output_ifaces: []
|
||||||
iptables__v4_filter_prepend: null
|
iptables__ssh_port: 22
|
||||||
iptables__v4_filter_append: null
|
iptables__ssh_ifaces: []
|
||||||
iptables__v4_nat: null
|
|
||||||
iptables__v6_filter_prepend: null
|
#############
|
||||||
iptables__v6_filter_append: null
|
# NAT table #
|
||||||
iptables__v6_nat: null
|
#############
|
||||||
|
|
||||||
|
iptables__nat_v4: null
|
||||||
|
iptables__nat_v6: null
|
||||||
|
iptables__nat_all: null
|
||||||
|
|
||||||
|
################
|
||||||
|
# Filter table #
|
||||||
|
################
|
||||||
|
|
||||||
|
iptables__filter_prepend0_v4: null
|
||||||
|
iptables__filter_prepend0_v6: null
|
||||||
|
iptables__filter_prepend0_all: null
|
||||||
|
iptables__filter_prepend1_v4: null
|
||||||
|
iptables__filter_prepend1_v6: null
|
||||||
|
iptables__filter_prepend1_all: null
|
||||||
|
iptables__filter_prepend2_v4: null
|
||||||
|
iptables__filter_prepend2_v6: null
|
||||||
|
iptables__filter_prepend2_all: null
|
||||||
|
|
||||||
|
iptables__filter_append0_v4: null
|
||||||
|
iptables__filter_append0_v6: null
|
||||||
|
iptables__filter_append0_all: null
|
||||||
|
iptables__filter_append1_v4: null
|
||||||
|
iptables__filter_append1_v6: null
|
||||||
|
iptables__filter_append1_all: null
|
||||||
|
iptables__filter_append2_v4: null
|
||||||
|
iptables__filter_append2_v6: null
|
||||||
|
iptables__filter_append2_all: null
|
||||||
|
|
||||||
|
iptables__filter_ssh_before_v4: null
|
||||||
|
iptables__filter_ssh_before_v6: null
|
||||||
|
iptables__filter_ssh_before_all: null
|
||||||
|
iptables__filter_ssh_after_v4: null
|
||||||
|
iptables__filter_ssh_after_v6: null
|
||||||
|
iptables__filter_ssh_after_all: null
|
||||||
|
|
||||||
|
iptables__filter_loop_before_v4: null
|
||||||
|
iptables__filter_loop_before_v6: null
|
||||||
|
iptables__filter_loop_before_all: null
|
||||||
|
iptables__filter_loop_after_v4: null
|
||||||
|
iptables__filter_loop_after_v6: null
|
||||||
|
iptables__filter_loop_after_all: null
|
||||||
|
|
||||||
|
iptables__filter_out_before_v4: null
|
||||||
|
iptables__filter_out_before_v6: null
|
||||||
|
iptables__filter_out_before_all: null
|
||||||
|
iptables__filter_out_after_v4: null
|
||||||
|
iptables__filter_out_after_v6: null
|
||||||
|
iptables__filter_out_after_all: null
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
---
|
---
|
||||||
- name: Load iptables rules for IPv4
|
- name: iptables | Load iptables rules for IPv4
|
||||||
shell: 'cat {{ iptables__conf_ipv4 }} | iptables-restore'
|
shell: 'cat {{ iptables__conf_ipv4 }} | iptables-restore'
|
||||||
|
|
||||||
- name: Load iptables rules for IPv6
|
- name: iptables | Load iptables rules for IPv6
|
||||||
shell: 'cat {{ iptables__conf_ipv6 }} | ip6tables-restore'
|
shell: 'cat {{ iptables__conf_ipv6 }} | ip6tables-restore'
|
||||||
|
|
|
@ -5,20 +5,24 @@ dependencies: []
|
||||||
galaxy_info:
|
galaxy_info:
|
||||||
role_name: iptables
|
role_name: iptables
|
||||||
author: Alex Kotov
|
author: Alex Kotov
|
||||||
description: Common configuration
|
description: iptables persistence
|
||||||
license: MIT
|
license: MIT
|
||||||
min_ansible_version: 2.8
|
min_ansible_version: 2.8
|
||||||
|
|
||||||
galaxy_tags:
|
galaxy_tags:
|
||||||
- iptables
|
- iptables
|
||||||
|
- firewall
|
||||||
|
- networking
|
||||||
|
|
||||||
platforms:
|
platforms:
|
||||||
- name: Debian
|
- name: Debian
|
||||||
versions:
|
versions:
|
||||||
- stretch # Debian 9 Stretch
|
- stretch # Debian 9 Stretch
|
||||||
- buster # Debian 10 Buster
|
- buster # Debian 10 Buster
|
||||||
|
- bullseye # Debian 11 Bullseye
|
||||||
- name: Ubuntu
|
- name: Ubuntu
|
||||||
versions:
|
versions:
|
||||||
- xenial # Ubuntu 16.04 LTS Xenial Xerus
|
- xenial # Ubuntu 16.04 LTS Xenial Xerus
|
||||||
- bionic # Ubuntu 18.04 LTS Bionic Beaver
|
- bionic # Ubuntu 18.04 LTS Bionic Beaver
|
||||||
- focal # Ubuntu 20.04 LTS Focal Fossa
|
- focal # Ubuntu 20.04 LTS Focal Fossa
|
||||||
|
- jammy # Ubuntu 22.04 LTS Jammy Jellyfish
|
||||||
|
|
|
@ -12,19 +12,19 @@
|
||||||
group: root
|
group: root
|
||||||
|
|
||||||
- name: Install iptables rules for IPv4
|
- name: Install iptables rules for IPv4
|
||||||
|
notify: iptables | Load iptables rules for IPv4
|
||||||
template:
|
template:
|
||||||
src: templates/rules.v4
|
src: templates/rules.v4
|
||||||
dest: '{{ iptables__conf_ipv4 }}'
|
dest: '{{ iptables__conf_ipv4 }}'
|
||||||
mode: 'u=rw,go=r'
|
mode: 'u=rw,go=r'
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
notify: Load iptables rules for IPv4
|
|
||||||
|
|
||||||
- name: Install iptables rules for IPv6
|
- name: Install iptables rules for IPv6
|
||||||
|
notify: iptables | Load iptables rules for IPv6
|
||||||
template:
|
template:
|
||||||
src: templates/rules.v6
|
src: templates/rules.v6
|
||||||
dest: '{{ iptables__conf_ipv6 }}'
|
dest: '{{ iptables__conf_ipv6 }}'
|
||||||
mode: 'u=rw,go=r'
|
mode: 'u=rw,go=r'
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
notify: Load iptables rules for IPv6
|
|
||||||
|
|
|
@ -1,35 +1,75 @@
|
||||||
#####
|
################################################################################
|
||||||
*nat
|
*nat
|
||||||
#####
|
################################################################################
|
||||||
|
|
||||||
:PREROUTING ACCEPT [0:0]
|
:PREROUTING ACCEPT [0:0]
|
||||||
:INPUT ACCEPT [0:0]
|
:INPUT ACCEPT [0:0]
|
||||||
:OUTPUT ACCEPT [0:0]
|
:OUTPUT ACCEPT [0:0]
|
||||||
:POSTROUTING ACCEPT [0:0]
|
:POSTROUTING ACCEPT [0:0]
|
||||||
|
|
||||||
# Remove all rules from all chains,
|
# Remove all rules from all chains.
|
||||||
# delete all user-defined chains.
|
|
||||||
-F
|
-F
|
||||||
|
# Delete all user-defined chains.
|
||||||
-X
|
-X
|
||||||
|
|
||||||
{{ iptables__v4_nat }}
|
{{ iptables__nat_v4 }}
|
||||||
|
{{ iptables__nat_all }}
|
||||||
|
|
||||||
COMMIT
|
COMMIT
|
||||||
|
|
||||||
########
|
|
||||||
|
|
||||||
|
################################################################################
|
||||||
*filter
|
*filter
|
||||||
########
|
################################################################################
|
||||||
|
|
||||||
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
||||||
:FORWARD DROP [0:0]
|
:FORWARD DROP [0:0]
|
||||||
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
||||||
|
|
||||||
# Remove all rules from all chains,
|
# Remove all rules from all chains.
|
||||||
# delete all user-defined chains.
|
|
||||||
-F
|
-F
|
||||||
|
# Delete all user-defined chains.
|
||||||
-X
|
-X
|
||||||
|
|
||||||
{{ iptables__v4_filter_prepend }}
|
##########
|
||||||
|
# Custom #
|
||||||
|
##########
|
||||||
|
|
||||||
|
{{ iptables__filter_prepend0_v6 }}
|
||||||
|
{{ iptables__filter_prepend0_all }}
|
||||||
|
{{ iptables__filter_prepend1_v6 }}
|
||||||
|
{{ iptables__filter_prepend1_all }}
|
||||||
|
{{ iptables__filter_prepend2_v6 }}
|
||||||
|
{{ iptables__filter_prepend2_all }}
|
||||||
|
|
||||||
|
#######
|
||||||
|
# SSH #
|
||||||
|
#######
|
||||||
|
|
||||||
|
{{ iptables__filter_ssh_before_v6 }}
|
||||||
|
{{ iptables__filter_ssh_before_all }}
|
||||||
|
|
||||||
|
# Allow incoming SSH.
|
||||||
|
{% if iptables__ssh_ifaces %}
|
||||||
|
{% for iface in iptables__ssh_ifaces %}
|
||||||
|
-A INPUT -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
||||||
|
-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||||||
|
{% endfor %}
|
||||||
|
{% else %}
|
||||||
|
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
||||||
|
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{{ iptables__filter_ssh_after_v6 }}
|
||||||
|
{{ iptables__filter_ssh_after_all }}
|
||||||
|
|
||||||
|
############
|
||||||
|
# Loopback #
|
||||||
|
############
|
||||||
|
|
||||||
|
{{ iptables__filter_loop_before_v6 }}
|
||||||
|
{{ iptables__filter_loop_before_all }}
|
||||||
|
|
||||||
# Allow all loopback (lo) traffic and reject anything
|
# Allow all loopback (lo) traffic and reject anything
|
||||||
# to localhost that does not originate from lo.
|
# to localhost that does not originate from lo.
|
||||||
|
@ -37,6 +77,16 @@ COMMIT
|
||||||
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
|
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
|
||||||
-A OUTPUT -o lo -j ACCEPT
|
-A OUTPUT -o lo -j ACCEPT
|
||||||
|
|
||||||
|
{{ iptables__filter_loop_after_v6 }}
|
||||||
|
{{ iptables__filter_loop_after_all }}
|
||||||
|
|
||||||
|
############
|
||||||
|
# Outgoing #
|
||||||
|
############
|
||||||
|
|
||||||
|
{{ iptables__filter_out_before_v6 }}
|
||||||
|
{{ iptables__filter_out_before_all }}
|
||||||
|
|
||||||
# Allow all outgoing traffic.
|
# Allow all outgoing traffic.
|
||||||
{% if iptables__allow_output_ifaces %}
|
{% if iptables__allow_output_ifaces %}
|
||||||
{% for iface in iptables__allow_output_ifaces %}
|
{% for iface in iptables__allow_output_ifaces %}
|
||||||
|
@ -48,6 +98,13 @@ COMMIT
|
||||||
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
|
{{ iptables__filter_out_after_v6 }}
|
||||||
|
{{ iptables__filter_out_after_all }}
|
||||||
|
|
||||||
|
########
|
||||||
|
# ICMP #
|
||||||
|
########
|
||||||
|
|
||||||
# Allow some important ICMP.
|
# Allow some important ICMP.
|
||||||
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
||||||
-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
|
-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
|
||||||
|
@ -62,10 +119,15 @@ COMMIT
|
||||||
-A INPUT -p icmp -j DROP
|
-A INPUT -p icmp -j DROP
|
||||||
-A OUTPUT -p icmp -j DROP
|
-A OUTPUT -p icmp -j DROP
|
||||||
|
|
||||||
# Allow incoming SSH.
|
##########
|
||||||
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
# Custom #
|
||||||
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
##########
|
||||||
|
|
||||||
{{ iptables__v4_filter_append }}
|
{{ iptables__filter_append0_v6 }}
|
||||||
|
{{ iptables__filter_append0_all }}
|
||||||
|
{{ iptables__filter_append1_v6 }}
|
||||||
|
{{ iptables__filter_append1_all }}
|
||||||
|
{{ iptables__filter_append2_v6 }}
|
||||||
|
{{ iptables__filter_append2_all }}
|
||||||
|
|
||||||
COMMIT
|
COMMIT
|
||||||
|
|
|
@ -1,35 +1,75 @@
|
||||||
#####
|
################################################################################
|
||||||
*nat
|
*nat
|
||||||
#####
|
################################################################################
|
||||||
|
|
||||||
:PREROUTING ACCEPT [0:0]
|
:PREROUTING ACCEPT [0:0]
|
||||||
:INPUT ACCEPT [0:0]
|
:INPUT ACCEPT [0:0]
|
||||||
:OUTPUT ACCEPT [0:0]
|
:OUTPUT ACCEPT [0:0]
|
||||||
:POSTROUTING ACCEPT [0:0]
|
:POSTROUTING ACCEPT [0:0]
|
||||||
|
|
||||||
# Remove all rules from all chains,
|
# Remove all rules from all chains.
|
||||||
# delete all user-defined chains.
|
|
||||||
-F
|
-F
|
||||||
|
# Delete all user-defined chains.
|
||||||
-X
|
-X
|
||||||
|
|
||||||
{{ iptables__v6_nat }}
|
{{ iptables__nat_v6 }}
|
||||||
|
{{ iptables__nat_all }}
|
||||||
|
|
||||||
COMMIT
|
COMMIT
|
||||||
|
|
||||||
########
|
|
||||||
|
|
||||||
|
################################################################################
|
||||||
*filter
|
*filter
|
||||||
########
|
################################################################################
|
||||||
|
|
||||||
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
||||||
:FORWARD DROP [0:0]
|
:FORWARD DROP [0:0]
|
||||||
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
||||||
|
|
||||||
# Remove all rules from all chains,
|
# Remove all rules from all chains.
|
||||||
# delete all user-defined chains.
|
|
||||||
-F
|
-F
|
||||||
|
# Delete all user-defined chains.
|
||||||
-X
|
-X
|
||||||
|
|
||||||
{{ iptables__v6_filter_prepend }}
|
##########
|
||||||
|
# Custom #
|
||||||
|
##########
|
||||||
|
|
||||||
|
{{ iptables__filter_prepend0_v4 }}
|
||||||
|
{{ iptables__filter_prepend0_all }}
|
||||||
|
{{ iptables__filter_prepend1_v4 }}
|
||||||
|
{{ iptables__filter_prepend1_all }}
|
||||||
|
{{ iptables__filter_prepend2_v4 }}
|
||||||
|
{{ iptables__filter_prepend2_all }}
|
||||||
|
|
||||||
|
#######
|
||||||
|
# SSH #
|
||||||
|
#######
|
||||||
|
|
||||||
|
{{ iptables__filter_ssh_before_v4 }}
|
||||||
|
{{ iptables__filter_ssh_before_all }}
|
||||||
|
|
||||||
|
# Allow incoming SSH.
|
||||||
|
{% if iptables__ssh_ifaces %}
|
||||||
|
{% for iface in iptables__ssh_ifaces %}
|
||||||
|
-A INPUT -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
||||||
|
-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||||||
|
{% endfor %}
|
||||||
|
{% else %}
|
||||||
|
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
||||||
|
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{{ iptables__filter_ssh_after_v4 }}
|
||||||
|
{{ iptables__filter_ssh_after_all }}
|
||||||
|
|
||||||
|
############
|
||||||
|
# Loopback #
|
||||||
|
############
|
||||||
|
|
||||||
|
{{ iptables__filter_loop_before_v4 }}
|
||||||
|
{{ iptables__filter_loop_before_all }}
|
||||||
|
|
||||||
# Allow all loopback (lo) traffic and reject anything
|
# Allow all loopback (lo) traffic and reject anything
|
||||||
# to localhost that does not originate from lo.
|
# to localhost that does not originate from lo.
|
||||||
|
@ -37,6 +77,16 @@ COMMIT
|
||||||
-A INPUT ! -i lo -s ::/128 -j REJECT
|
-A INPUT ! -i lo -s ::/128 -j REJECT
|
||||||
-A OUTPUT -o lo -j ACCEPT
|
-A OUTPUT -o lo -j ACCEPT
|
||||||
|
|
||||||
|
{{ iptables__filter_loop_after_v4 }}
|
||||||
|
{{ iptables__filter_loop_after_all }}
|
||||||
|
|
||||||
|
############
|
||||||
|
# Outgoing #
|
||||||
|
############
|
||||||
|
|
||||||
|
{{ iptables__filter_out_before_v4 }}
|
||||||
|
{{ iptables__filter_out_before_all }}
|
||||||
|
|
||||||
# Allow all outgoing traffic.
|
# Allow all outgoing traffic.
|
||||||
{% if iptables__allow_output_ifaces %}
|
{% if iptables__allow_output_ifaces %}
|
||||||
{% for iface in iptables__allow_output_ifaces %}
|
{% for iface in iptables__allow_output_ifaces %}
|
||||||
|
@ -48,6 +98,13 @@ COMMIT
|
||||||
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
|
{{ iptables__filter_out_after_v4 }}
|
||||||
|
{{ iptables__filter_out_after_all }}
|
||||||
|
|
||||||
|
########
|
||||||
|
# ICMP #
|
||||||
|
########
|
||||||
|
|
||||||
# Allow some important ICMP.
|
# Allow some important ICMP.
|
||||||
-A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
-A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
||||||
-A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
-A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
||||||
|
@ -73,10 +130,15 @@ COMMIT
|
||||||
-A INPUT -p icmpv6 -j DROP
|
-A INPUT -p icmpv6 -j DROP
|
||||||
-A OUTPUT -p icmpv6 -j DROP
|
-A OUTPUT -p icmpv6 -j DROP
|
||||||
|
|
||||||
# Allow incoming SSH.
|
##########
|
||||||
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
# Custom #
|
||||||
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
##########
|
||||||
|
|
||||||
{{ iptables__v6_filter_append }}
|
{{ iptables__filter_append0_v4 }}
|
||||||
|
{{ iptables__filter_append0_all }}
|
||||||
|
{{ iptables__filter_append1_v4 }}
|
||||||
|
{{ iptables__filter_append1_all }}
|
||||||
|
{{ iptables__filter_append2_v4 }}
|
||||||
|
{{ iptables__filter_append2_all }}
|
||||||
|
|
||||||
COMMIT
|
COMMIT
|
||||||
|
|
Loading…
Reference in New Issue