Alan Orth
d030827f12
Now that I'm blocking ~10,000 malicious IPs from AbuseIPDB I feel more comfortable using a more relaxed rate limit for SSH. A limit of 12 per minute is about one every five seconds.
77 lines
2.0 KiB
Django/Jinja
77 lines
2.0 KiB
Django/Jinja
<zone>
|
|
<short>Public</short>
|
|
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<interface name="{{ ansible_default_ipv4.interface }}"/>
|
|
|
|
{# ssh rules #}
|
|
<rule family="ipv4">
|
|
<source address="0.0.0.0/0"/>
|
|
<port protocol="tcp" port="22"/>
|
|
<accept>
|
|
<limit value="12/m"/>
|
|
</accept>
|
|
</rule>
|
|
|
|
{# ipv6 ssh rules #}
|
|
<rule family="ipv6">
|
|
<source address="::/0"/>
|
|
<port protocol="tcp" port="22"/>
|
|
<accept>
|
|
<limit value="12/m"/>
|
|
</accept>
|
|
</rule>
|
|
|
|
{# web rules #}
|
|
<rule family="ipv4">
|
|
<source address="0.0.0.0/0"/>
|
|
<port protocol="tcp" port="80"/>
|
|
<accept/>
|
|
</rule>
|
|
|
|
{# ipv6 web rules #}
|
|
<rule family="ipv6">
|
|
<source address="::/0"/>
|
|
<port protocol="tcp" port="80"/>
|
|
<accept/>
|
|
</rule>
|
|
|
|
{# munin rules #}
|
|
{% if munin_master_host is defined %}
|
|
<rule family="ipv4">
|
|
<source address="{{ ghetto_ipsets[munin_master_host].src }}"/>
|
|
<port protocol="tcp" port="{{ munin_node_port }}"/>
|
|
<accept/>
|
|
</rule>
|
|
{% endif %}
|
|
|
|
{# extra rules #}
|
|
{% if extra_iptables_rules is defined %}
|
|
{% for rule in extra_iptables_rules %}
|
|
<rule family="ipv4">
|
|
<source address="{{ ghetto_ipsets[rule.acl].src }}"/>
|
|
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
|
<accept/>
|
|
</rule>
|
|
|
|
{# ipv6 extra rules #}
|
|
{% if ghetto_ipsets[rule.acl].ipv6src is defined %}
|
|
<rule family="ipv6">
|
|
<source address="{{ ghetto_ipsets[rule.acl].ipv6src }}"/>
|
|
<port protocol="{{ rule.protocol }}" port="{{ rule.port }}"/>
|
|
<accept/>
|
|
</rule>
|
|
{% endif %}
|
|
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
<rule>
|
|
<source ipset="abusers-ipv4"/>
|
|
<drop/>
|
|
</rule>
|
|
<rule>
|
|
<source ipset="abusers-ipv6"/>
|
|
<drop/>
|
|
</rule>
|
|
</zone>
|