145 lines
4.2 KiB
Plaintext
145 lines
4.2 KiB
Plaintext
################################################################################
|
|
*nat
|
|
################################################################################
|
|
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
|
|
# Remove all rules from all chains.
|
|
-F
|
|
# Delete all user-defined chains.
|
|
-X
|
|
|
|
{{ iptables__nat_v6 }}
|
|
{{ iptables__nat_all }}
|
|
|
|
COMMIT
|
|
|
|
|
|
|
|
################################################################################
|
|
*filter
|
|
################################################################################
|
|
|
|
:INPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
|
|
|
|
# Remove all rules from all chains.
|
|
-F
|
|
# Delete all user-defined chains.
|
|
-X
|
|
|
|
##########
|
|
# Custom #
|
|
##########
|
|
|
|
{{ iptables__filter_prepend0_v4 }}
|
|
{{ iptables__filter_prepend0_all }}
|
|
{{ iptables__filter_prepend1_v4 }}
|
|
{{ iptables__filter_prepend1_all }}
|
|
{{ iptables__filter_prepend2_v4 }}
|
|
{{ iptables__filter_prepend2_all }}
|
|
|
|
#######
|
|
# SSH #
|
|
#######
|
|
|
|
{{ iptables__filter_ssh_before_v4 }}
|
|
{{ iptables__filter_ssh_before_all }}
|
|
|
|
# Allow incoming SSH.
|
|
{% if iptables__ssh_ifaces %}
|
|
{% for iface in iptables__ssh_ifaces %}
|
|
-A INPUT -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
|
-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
|
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
|
{% endif %}
|
|
|
|
{{ iptables__filter_ssh_after_v4 }}
|
|
{{ iptables__filter_ssh_after_all }}
|
|
|
|
############
|
|
# Loopback #
|
|
############
|
|
|
|
{{ iptables__filter_loop_before_v4 }}
|
|
{{ iptables__filter_loop_before_all }}
|
|
|
|
# Allow all loopback (lo) traffic and reject anything
|
|
# to localhost that does not originate from lo.
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT ! -i lo -s ::/128 -j REJECT
|
|
-A OUTPUT -o lo -j ACCEPT
|
|
|
|
{{ iptables__filter_loop_after_v4 }}
|
|
{{ iptables__filter_loop_after_all }}
|
|
|
|
############
|
|
# Outgoing #
|
|
############
|
|
|
|
{{ iptables__filter_out_before_v4 }}
|
|
{{ iptables__filter_out_before_all }}
|
|
|
|
# Allow all outgoing traffic.
|
|
{% if iptables__allow_output_ifaces %}
|
|
{% for iface in iptables__allow_output_ifaces %}
|
|
-A OUTPUT -o {{ iface }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
|
-A INPUT -i {{ iface }} -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
-A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
|
|
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
|
|
{% endif %}
|
|
|
|
{{ iptables__filter_out_after_v4 }}
|
|
{{ iptables__filter_out_after_all }}
|
|
|
|
########
|
|
# ICMP #
|
|
########
|
|
|
|
# Allow some important ICMP.
|
|
-A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
|
|
# TODO: maybe it's better to only allow these inside private network?
|
|
-A INPUT -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type neighbour-solicitation -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type neighbour-solicitation -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type neighbour-advertisement -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type redirect -j ACCEPT
|
|
-A OUTPUT -p icmpv6 --icmpv6-type redirect -j ACCEPT
|
|
|
|
# Deny other ICMPv6.
|
|
-A INPUT -p icmpv6 -j DROP
|
|
-A OUTPUT -p icmpv6 -j DROP
|
|
|
|
##########
|
|
# Custom #
|
|
##########
|
|
|
|
{{ iptables__filter_append0_v4 }}
|
|
{{ iptables__filter_append0_all }}
|
|
{{ iptables__filter_append1_v4 }}
|
|
{{ iptables__filter_append1_all }}
|
|
{{ iptables__filter_append2_v4 }}
|
|
{{ iptables__filter_append2_all }}
|
|
|
|
COMMIT
|