Compare commits

...

8 Commits

Author SHA1 Message Date
Alex Kotov 932223211e
Rewrite rules 2023-06-22 19:00:36 +04:00
Alex Kotov f4fc8adf7b
Add more platforms 2023-03-28 12:40:40 +04:00
Alex Kotov 21de434815
Add Ansible Galaxy tags 2021-09-19 00:26:54 +05:00
Alex Kotov 0d8aac958d
Reorder code 2021-09-19 00:21:56 +05:00
Alex Kotov 996800a848
Rename handlers 2021-09-19 00:21:26 +05:00
Alex Kotov 8a0c3463c1
Fix bug 2021-09-15 04:33:59 +05:00
Alex Kotov 8f22bec689
Allow to init iptables rules 2021-09-15 04:30:43 +05:00
Alex Kotov 77ec14c284
Allow to prepend iptables rules for both IPv4 and IPv6 2021-09-15 03:36:13 +05:00
6 changed files with 215 additions and 38 deletions

View File

@ -2,9 +2,58 @@
iptables__state: install iptables__state: install
iptables__drop_by_default: false iptables__drop_by_default: false
iptables__allow_output_ifaces: [] iptables__allow_output_ifaces: []
iptables__v4_filter_prepend: null iptables__ssh_port: 22
iptables__v4_filter_append: null iptables__ssh_ifaces: []
iptables__v4_nat: null
iptables__v6_filter_prepend: null #############
iptables__v6_filter_append: null # NAT table #
iptables__v6_nat: null #############
iptables__nat_v4: null
iptables__nat_v6: null
iptables__nat_all: null
################
# Filter table #
################
iptables__filter_prepend0_v4: null
iptables__filter_prepend0_v6: null
iptables__filter_prepend0_all: null
iptables__filter_prepend1_v4: null
iptables__filter_prepend1_v6: null
iptables__filter_prepend1_all: null
iptables__filter_prepend2_v4: null
iptables__filter_prepend2_v6: null
iptables__filter_prepend2_all: null
iptables__filter_append0_v4: null
iptables__filter_append0_v6: null
iptables__filter_append0_all: null
iptables__filter_append1_v4: null
iptables__filter_append1_v6: null
iptables__filter_append1_all: null
iptables__filter_append2_v4: null
iptables__filter_append2_v6: null
iptables__filter_append2_all: null
iptables__filter_ssh_before_v4: null
iptables__filter_ssh_before_v6: null
iptables__filter_ssh_before_all: null
iptables__filter_ssh_after_v4: null
iptables__filter_ssh_after_v6: null
iptables__filter_ssh_after_all: null
iptables__filter_loop_before_v4: null
iptables__filter_loop_before_v6: null
iptables__filter_loop_before_all: null
iptables__filter_loop_after_v4: null
iptables__filter_loop_after_v6: null
iptables__filter_loop_after_all: null
iptables__filter_out_before_v4: null
iptables__filter_out_before_v6: null
iptables__filter_out_before_all: null
iptables__filter_out_after_v4: null
iptables__filter_out_after_v6: null
iptables__filter_out_after_all: null

View File

@ -1,6 +1,6 @@
--- ---
- name: Load iptables rules for IPv4 - name: iptables | Load iptables rules for IPv4
shell: 'cat {{ iptables__conf_ipv4 }} | iptables-restore' shell: 'cat {{ iptables__conf_ipv4 }} | iptables-restore'
- name: Load iptables rules for IPv6 - name: iptables | Load iptables rules for IPv6
shell: 'cat {{ iptables__conf_ipv6 }} | ip6tables-restore' shell: 'cat {{ iptables__conf_ipv6 }} | ip6tables-restore'

View File

@ -11,14 +11,18 @@ galaxy_info:
galaxy_tags: galaxy_tags:
- iptables - iptables
- firewall
- networking
platforms: platforms:
- name: Debian - name: Debian
versions: versions:
- stretch # Debian 9 Stretch - stretch # Debian 9 Stretch
- buster # Debian 10 Buster - buster # Debian 10 Buster
- bullseye # Debian 11 Bullseye
- name: Ubuntu - name: Ubuntu
versions: versions:
- xenial # Ubuntu 16.04 LTS Xenial Xerus - xenial # Ubuntu 16.04 LTS Xenial Xerus
- bionic # Ubuntu 18.04 LTS Bionic Beaver - bionic # Ubuntu 18.04 LTS Bionic Beaver
- focal # Ubuntu 20.04 LTS Focal Fossa - focal # Ubuntu 20.04 LTS Focal Fossa
- jammy # Ubuntu 22.04 LTS Jammy Jellyfish

View File

@ -12,19 +12,19 @@
group: root group: root
- name: Install iptables rules for IPv4 - name: Install iptables rules for IPv4
notify: iptables | Load iptables rules for IPv4
template: template:
src: templates/rules.v4 src: templates/rules.v4
dest: '{{ iptables__conf_ipv4 }}' dest: '{{ iptables__conf_ipv4 }}'
mode: 'u=rw,go=r' mode: 'u=rw,go=r'
owner: root owner: root
group: root group: root
notify: Load iptables rules for IPv4
- name: Install iptables rules for IPv6 - name: Install iptables rules for IPv6
notify: iptables | Load iptables rules for IPv6
template: template:
src: templates/rules.v6 src: templates/rules.v6
dest: '{{ iptables__conf_ipv6 }}' dest: '{{ iptables__conf_ipv6 }}'
mode: 'u=rw,go=r' mode: 'u=rw,go=r'
owner: root owner: root
group: root group: root
notify: Load iptables rules for IPv6

View File

@ -1,35 +1,75 @@
##### ################################################################################
*nat *nat
##### ################################################################################
:PREROUTING ACCEPT [0:0] :PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0] :INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0]
# Remove all rules from all chains, # Remove all rules from all chains.
# delete all user-defined chains.
-F -F
# Delete all user-defined chains.
-X -X
{{ iptables__v4_nat }} {{ iptables__nat_v4 }}
{{ iptables__nat_all }}
COMMIT COMMIT
########
################################################################################
*filter *filter
######## ################################################################################
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0] :INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
:FORWARD DROP [0:0] :FORWARD DROP [0:0]
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0] :OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
# Remove all rules from all chains, # Remove all rules from all chains.
# delete all user-defined chains.
-F -F
# Delete all user-defined chains.
-X -X
{{ iptables__v4_filter_prepend }} ##########
# Custom #
##########
{{ iptables__filter_prepend0_v6 }}
{{ iptables__filter_prepend0_all }}
{{ iptables__filter_prepend1_v6 }}
{{ iptables__filter_prepend1_all }}
{{ iptables__filter_prepend2_v6 }}
{{ iptables__filter_prepend2_all }}
#######
# SSH #
#######
{{ iptables__filter_ssh_before_v6 }}
{{ iptables__filter_ssh_before_all }}
# Allow incoming SSH.
{% if iptables__ssh_ifaces %}
{% for iface in iptables__ssh_ifaces %}
-A INPUT -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
{% endfor %}
{% else %}
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
{% endif %}
{{ iptables__filter_ssh_after_v6 }}
{{ iptables__filter_ssh_after_all }}
############
# Loopback #
############
{{ iptables__filter_loop_before_v6 }}
{{ iptables__filter_loop_before_all }}
# Allow all loopback (lo) traffic and reject anything # Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo. # to localhost that does not originate from lo.
@ -37,6 +77,16 @@ COMMIT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A OUTPUT -o lo -j ACCEPT -A OUTPUT -o lo -j ACCEPT
{{ iptables__filter_loop_after_v6 }}
{{ iptables__filter_loop_after_all }}
############
# Outgoing #
############
{{ iptables__filter_out_before_v6 }}
{{ iptables__filter_out_before_all }}
# Allow all outgoing traffic. # Allow all outgoing traffic.
{% if iptables__allow_output_ifaces %} {% if iptables__allow_output_ifaces %}
{% for iface in iptables__allow_output_ifaces %} {% for iface in iptables__allow_output_ifaces %}
@ -48,6 +98,13 @@ COMMIT
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
{% endif %} {% endif %}
{{ iptables__filter_out_after_v6 }}
{{ iptables__filter_out_after_all }}
########
# ICMP #
########
# Allow some important ICMP. # Allow some important ICMP.
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
@ -62,10 +119,15 @@ COMMIT
-A INPUT -p icmp -j DROP -A INPUT -p icmp -j DROP
-A OUTPUT -p icmp -j DROP -A OUTPUT -p icmp -j DROP
# Allow incoming SSH. ##########
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT # Custom #
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT ##########
{{ iptables__v4_filter_append }} {{ iptables__filter_append0_v6 }}
{{ iptables__filter_append0_all }}
{{ iptables__filter_append1_v6 }}
{{ iptables__filter_append1_all }}
{{ iptables__filter_append2_v6 }}
{{ iptables__filter_append2_all }}
COMMIT COMMIT

View File

@ -1,35 +1,75 @@
##### ################################################################################
*nat *nat
##### ################################################################################
:PREROUTING ACCEPT [0:0] :PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0] :INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0]
# Remove all rules from all chains, # Remove all rules from all chains.
# delete all user-defined chains.
-F -F
# Delete all user-defined chains.
-X -X
{{ iptables__v6_nat }} {{ iptables__nat_v6 }}
{{ iptables__nat_all }}
COMMIT COMMIT
########
################################################################################
*filter *filter
######## ################################################################################
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0] :INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
:FORWARD DROP [0:0] :FORWARD DROP [0:0]
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0] :OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
# Remove all rules from all chains, # Remove all rules from all chains.
# delete all user-defined chains.
-F -F
# Delete all user-defined chains.
-X -X
{{ iptables__v6_filter_prepend }} ##########
# Custom #
##########
{{ iptables__filter_prepend0_v4 }}
{{ iptables__filter_prepend0_all }}
{{ iptables__filter_prepend1_v4 }}
{{ iptables__filter_prepend1_all }}
{{ iptables__filter_prepend2_v4 }}
{{ iptables__filter_prepend2_all }}
#######
# SSH #
#######
{{ iptables__filter_ssh_before_v4 }}
{{ iptables__filter_ssh_before_all }}
# Allow incoming SSH.
{% if iptables__ssh_ifaces %}
{% for iface in iptables__ssh_ifaces %}
-A INPUT -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
{% endfor %}
{% else %}
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
{% endif %}
{{ iptables__filter_ssh_after_v4 }}
{{ iptables__filter_ssh_after_all }}
############
# Loopback #
############
{{ iptables__filter_loop_before_v4 }}
{{ iptables__filter_loop_before_all }}
# Allow all loopback (lo) traffic and reject anything # Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo. # to localhost that does not originate from lo.
@ -37,6 +77,16 @@ COMMIT
-A INPUT ! -i lo -s ::/128 -j REJECT -A INPUT ! -i lo -s ::/128 -j REJECT
-A OUTPUT -o lo -j ACCEPT -A OUTPUT -o lo -j ACCEPT
{{ iptables__filter_loop_after_v4 }}
{{ iptables__filter_loop_after_all }}
############
# Outgoing #
############
{{ iptables__filter_out_before_v4 }}
{{ iptables__filter_out_before_all }}
# Allow all outgoing traffic. # Allow all outgoing traffic.
{% if iptables__allow_output_ifaces %} {% if iptables__allow_output_ifaces %}
{% for iface in iptables__allow_output_ifaces %} {% for iface in iptables__allow_output_ifaces %}
@ -48,6 +98,13 @@ COMMIT
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
{% endif %} {% endif %}
{{ iptables__filter_out_after_v4 }}
{{ iptables__filter_out_after_all }}
########
# ICMP #
########
# Allow some important ICMP. # Allow some important ICMP.
-A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT -A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
@ -73,10 +130,15 @@ COMMIT
-A INPUT -p icmpv6 -j DROP -A INPUT -p icmpv6 -j DROP
-A OUTPUT -p icmpv6 -j DROP -A OUTPUT -p icmpv6 -j DROP
# Allow incoming SSH. ##########
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT # Custom #
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT ##########
{{ iptables__v6_filter_append }} {{ iptables__filter_append0_v4 }}
{{ iptables__filter_append0_all }}
{{ iptables__filter_append1_v4 }}
{{ iptables__filter_append1_all }}
{{ iptables__filter_append2_v4 }}
{{ iptables__filter_append2_all }}
COMMIT COMMIT