258 lines
9.5 KiB
Django/Jinja
258 lines
9.5 KiB
Django/Jinja
#
|
|
# don't manually modify this file
|
|
#
|
|
*filter
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
|
|
# We manage the banned IP/networks list before anything else
|
|
{% if iptables_banlist is defined %}
|
|
{% for obj in iptables_banlist %}
|
|
{% if obj.proto is defined and obj.destport is defined and obj.sourceport is defined %}
|
|
-A INPUT -m {{ obj.proto }} -p {{ obj.proto }} -s {{ obj.source }} --sport {{ obj.sourceport }} --dport {{ obj.destport }} -j {{ iptables_banned_default_policy }}
|
|
{% elif obj.proto is defined and obj.destport is defined %}
|
|
-A INPUT -m {{ obj.proto }} -p {{ obj.proto }} -s {{ obj.source }} --dport {{ obj.destport }} -j {{ iptables_banned_default_policy }}
|
|
{% elif obj.proto is defined %}
|
|
-A INPUT -m {{ obj.proto }} -p {{ obj.proto }} -s {{ obj.source }} -j {{ iptables_banned_default_policy }}
|
|
{% else %}
|
|
-A INPUT -s {{ obj.source }} -j {{ iptables_banned_default_policy }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
-A INPUT -p icmp -j ACCEPT
|
|
-A INPUT -i lo -j ACCEPT
|
|
#
|
|
{% if iptables_managed_ssh is defined and iptables_managed_ssh %}
|
|
{% if iptables_ssh_allowed_hosts is defined %}
|
|
# ssh is not open to all, even if we use denyhosts to prevent unauthorized accesses
|
|
{% for ip in iptables_ssh_allowed_hosts %}
|
|
-A INPUT -m state --state NEW -m tcp -p tcp -s {{ ip }} --dport 22 -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% else %}
|
|
# ssh is always open. We use denyhosts to prevent unauthorized accesses
|
|
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
|
|
{% endif %}
|
|
{% if iptables_open_all_to_isti_nets is defined and iptables_open_all_to_isti_nets %}
|
|
# Permit all traffic from our networks
|
|
-A INPUT -s {{ network.isti }} -j ACCEPT
|
|
-A INPUT -s {{ network.nmis }} -j ACCEPT
|
|
-A INPUT -s {{ network.eduroam }} -j ACCEPT
|
|
{% endif %}
|
|
{% if http_port is defined %}
|
|
# http
|
|
{% if http_allowed_hosts is defined %}
|
|
{% for ip in http_allowed_hosts %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ http_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
-A INPUT -m state --state NEW -m tcp -p tcp --dport {{ http_port }} -j ACCEPT
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if https_port is defined %}
|
|
# https
|
|
{% if https_allowed_hosts is defined %}
|
|
{% for ip in https_allowed_hosts %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ https_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
-A INPUT -m state --state NEW -m tcp -p tcp --dport {{ https_port }} -j ACCEPT
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if psql_db_port is defined %}
|
|
{% if psql_listen_on_ext_int %}
|
|
# postgresql clients
|
|
{% for db in psql_db_data %}
|
|
{% for ip in db.allowed_hosts %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ psql_db_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
-A INPUT -m state --state NEW -s {{ ansible_default_ipv4.address }} -p tcp -m tcp --dport {{ psql_db_port }} -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport {{ psql_db_port }} -j DROP
|
|
{% endif %}
|
|
|
|
{% if mysql_db_port is defined %}
|
|
{% if mysql_listen_on_ext_int %}
|
|
# mysql clients
|
|
{% for db in mysql_db_data %}
|
|
{% for ip in db.allowed_hosts %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ mysql_db_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
-A INPUT -m state --state NEW -s {{ ansible_default_ipv4.address }} -p tcp -m tcp --dport {{ mysql_db_port }} -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport {{ mysql_db_port }} -j DROP
|
|
{% endif %}
|
|
|
|
{% if openldap_slapd_tcp_port is defined %}
|
|
{% if openldap_allowed_clients is defined %}
|
|
{% for addr in openldap_allowed_clients %}
|
|
{% if not openldap_slapd_ssl_only %}
|
|
-A INPUT -m state --state NEW -s {{ addr }} -p tcp -m tcp --dport {{ openldap_slapd_tcp_port }} -j ACCEPT
|
|
{% endif %}
|
|
-A INPUT -m state --state NEW -s {{ addr }} -p tcp -m tcp --dport {{ openldap_slapd_ssl_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
{% if not openldap_slapd_ssl_only %}
|
|
-A INPUT -m state --state NEW -p tcp -m tcp --dport {{ openldap_slapd_tcp_port }} -j ACCEPT
|
|
{% endif %}
|
|
-A INPUT -m state --state NEW -p tcp -m tcp --dport {{ openldap_slapd_ssl_port }} -j ACCEPT
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if mongodb_allowed_hosts is defined %}
|
|
# mongodb clients
|
|
{% for ip in mongodb_allowed_hosts %}
|
|
{% if mongodb_tcp_port is defined %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ mongodb_tcp_port }} -j ACCEPT
|
|
{% else %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport 27017 -j ACCEPT
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% if mongodb_tcp_port is defined %}
|
|
-A INPUT -p tcp -m tcp --dport {{ mongodb_tcp_port }} -j DROP
|
|
{% else %}
|
|
-A INPUT -p tcp -m tcp --dport 27017 -j DROP
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if dnet_ports is defined %}
|
|
# dnet services
|
|
{% for tcp_port in dnet_ports %}
|
|
-A INPUT -m state --state NEW -p tcp -m tcp --dport {{ tcp_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if dnet_jmx_ports is defined %}
|
|
# dnet jmx ports. Open to the isti networks only
|
|
{% for tcp_port in dnet_jmx_ports %}
|
|
-A INPUT -m state --state NEW -p tcp -m tcp -s {{ network.isti }} --dport {{ tcp_port }} -j ACCEPT
|
|
-A INPUT -m state --state NEW -p tcp -m tcp -s {{ network.nmis }} --dport {{ tcp_port }} -j ACCEPT
|
|
-A INPUT -m state --state NEW -p tcp -m tcp -s {{ network.eduroam }} --dport {{ tcp_port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if vsftpd_iptables_rules is defined and vsftpd_iptables_rules %}
|
|
# Someone still uses ftp
|
|
{% if vsftpd_iptables_allowed_hosts is defined and vsftpd_iptables_allowed_hosts %}
|
|
{% for ip in vsftpd_iptables_allowed_hosts %}
|
|
-A INPUT -m state --state NEW -m tcp -p tcp -s {{ ip }} --dport ftp -j ACCEPT
|
|
-A INPUT -m state --state NEW,RELATED -m tcp -p tcp -s {{ ip }} --dport {{ vsftpd_pasv_min_port }}:{{ vsftpd_pasv_max_port }} -j ACCEPT
|
|
{% endfor %}
|
|
-A INPUT -m helper --helper ftp -j ACCEPT
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if nagios_enabled is defined %}
|
|
{% if nagios_enabled %}
|
|
{% if nagios_monitoring_server_ip is defined %}
|
|
{% for ip in nagios_monitoring_server_ip %}
|
|
# Nagios NRPE
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport 5666 -j ACCEPT
|
|
# Check ntp from the nagios server
|
|
-A INPUT -s {{ ip }} -p udp -m udp --dport 123 -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if configure_munin is defined %}
|
|
{% if configure_munin %}
|
|
{% if munin_server %}
|
|
{% for ip in munin_server %}
|
|
# Munin
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport 4949 -j ACCEPT
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if ganglia_enabled is defined %}
|
|
{% if ganglia_enabled %}
|
|
{% if ganglia_gmond_cluster_port is defined %}
|
|
# Ganglia
|
|
{% if ganglia_gmond_use_jmxtrans is not defined or not ganglia_gmond_use_jmxtrans %}
|
|
-A INPUT -m pkttype --pkt-type multicast -d {{ ganglia_gmond_mcast_addr }} -j ACCEPT
|
|
{% else %}
|
|
-A INPUT -m pkttype --pkt-type multicast -j ACCEPT
|
|
-A INPUT -p udp -m udp -d {{ ganglia_gmond_mcast_addr }} --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT
|
|
{% endif %}
|
|
-A INPUT -m state --state NEW -s {{ ganglia_gmetad_host }} -p tcp -m tcp --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT
|
|
-A INPUT -s {{ ganglia_gmetad_host }} -p udp -m udp --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if postfix_relay_server is defined %}
|
|
{% if postfix_relay_server %}
|
|
#
|
|
# These are only needed on the machines that act as relay servers
|
|
#
|
|
-A INPUT -p tcp -m multiport --dports 25,587,465 -s {{ network.nmis }} -j ACCEPT
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
|
|
{% if postfix_use_relay_host is defined and postfix_use_relay_host %}
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -m owner --gid-owner postfix -d {{ postfix_relay_host }} -j ACCEPT
|
|
{% else %}
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -m owner --gid-owner postfix -j ACCEPT
|
|
{% endif %}
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -m state --state NEW -j LOG --log-prefix "LOCAL_DROPPED_SPAM " --log-uid
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -j DROP
|
|
{% endif %}
|
|
{% endif %}
|
|
{% if postfix_relay_server is defined and not postfix_relay_server %}
|
|
{% if postfix_relay_client is defined%}
|
|
{% if postfix_relay_client %}
|
|
#
|
|
# When we are not a relay server but we want send email using our relay
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -m owner --gid-owner postfix -d {{ postfix_relay_host }} -j ACCEPT
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -m state --state NEW -j LOG --log-prefix "LOCAL_DROPPED_SPAM " --log-uid
|
|
-A OUTPUT -p tcp -m multiport --dports 25,587,465 -j DROP
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if iptables is defined %}
|
|
{% if iptables.tcp_rules is defined and iptables.tcp_rules %}
|
|
{% for tcp_rule in iptables.tcp %}
|
|
{% if tcp_rule.allowed_hosts is defined %}
|
|
{% for ip in tcp_rule.allowed_hosts %}
|
|
-A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ tcp_rule.port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
-A INPUT -m state --state NEW -m tcp -p tcp --dport {{ tcp_rule.port }} -j ACCEPT
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if iptables.udp_rules is defined and iptables.udp_rules %}
|
|
{% for udp_rule in iptables.udp %}
|
|
{% if udp_rule.allowed_hosts is defined %}
|
|
{% for ip in udp_rule.allowed_hosts %}
|
|
-A INPUT -s {{ ip }} -p udp -m udp --dport {{ udp_rule.port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% else %}
|
|
-A INPUT -p udp -m udp --dport {{ udp_rule.port }} -j ACCEPT
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endif %}
|
|
#
|
|
#
|
|
-A INPUT -s 125.24.0.0/14 -j DROP
|
|
{% if iptables_default_policy == 'REJECT' %}
|
|
-A INPUT -j REJECT --reject-with icmp-host-prohibited
|
|
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
|
|
{% else %}
|
|
-A INPUT -j {{ iptables_default_policy }}
|
|
-A FORWARD -j {{ iptables_default_policy }}
|
|
{% endif %}
|
|
|
|
COMMIT
|