alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity

Compare commits

base: alanorth:14814aa5d9b8972f116083fd0c6c7e4fa259f9bf
Branches Tags
alanorth:master alanorth:alpine
..
compare: alanorth:8bc2b6f4935c9bb30425d7f24e027abe4ed2df20
Branches Tags
alanorth:master alanorth:alpine

3 Commits
14814aa5d9 ... 8bc2b6f493

Author SHA1 Message Date
Alan Orth
8bc2b6f493 roles/common: Retab nftables.conf.j2 2021-07-27 22:03:23 +03:00
Alan Orth
a74d6dfc08 roles/common: Don't overwrite spamhaus nft sets 
The ones in this repo are only placeholders that get updated by the
update-spamhaus-nftables service, so we shouldn't overwrite them if
they exist.
 2021-07-27 22:01:57 +03:00
Alan Orth
d3922e7878 roles/common: Port configurable firewall logic to nftables 
This opens TCP port 22 on all hosts, TCP ports 80 and 443 on hosts
in the web group, and allows configuration of "extra" rules in the
host or group vars.
 2021-07-27 21:22:32 +03:00
2 changed files with 40 additions and 18 deletions
Expand all files Collapse all files

2
roles/common/tasks/firewall_Debian.yml
View File

@ -39,7 +39,7 @@
- name: Copy extra nftables configuration files - name: Copy extra nftables configuration files
when: ansible_distribution_major_version is version('11', '>=') when: ansible_distribution_major_version is version('11', '>=')
copy: src={{ item }} dest=/etc/nftables/{{ item }} owner=root group=root mode=0644 copy: src={{ item }} dest=/etc/nftables/{{ item }} owner=root group=root mode=0644 force=no
loop: loop:
- spamhaus-ipv4.nft - spamhaus-ipv4.nft
- spamhaus-ipv6.nft - spamhaus-ipv6.nft

24
roles/common/templates/nftables.conf.j2
View File

@ -48,7 +48,29 @@ table inet filter {
ip6 nexthdr ipv6-icmp limit rate 4/second accept ip6 nexthdr ipv6-icmp limit rate 4/second accept
ip protocol igmp limit rate 4/second accept ip protocol igmp limit rate 4/second accept
ip saddr 172.20.0.1 ct state new tcp dport 22 counter accept {# SSH rules #}
ip saddr 0.0.0.0/0 ct state new tcp dport 22 counter accept
ip6 saddr ::/0 ct state new tcp dport 22 counter accept
{# Web rules #}
{% if 'web' in group_names %}
ip saddr 0.0.0.0/0 ct state new tcp dport 80 counter accept
ip saddr 0.0.0.0/0 ct state new tcp dport 443 counter accept
ip6 saddr ::/0 ct state new tcp dport 80 counter accept
ip6 saddr ::/0 ct state new tcp dport 443 counter accept
{% endif %}
{# Extra rules #}
{% if extra_iptables_rules is defined %}
{% for rule in extra_iptables_rules %}
ip saddr {{ ghetto_ipsets[rule.acl].src }} ct state new {{ rule.protocol }} dport {{ rule.port }} counter accept
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
ip6 saddr {{ ghetto_ipsets[rule.acl].ipv6src }} ct state new {{ rule.protocol }} dport {{ rule.port }} counter accept
{% endif %}
{% endfor %}
{% endif %}
# everything else # everything else
reject with icmpx type port-unreachable reject with icmpx type port-unreachable