# # {{ ansible_managed }} don't manually modify this file # *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] # We manage the banned IP/networks list before anything else {% if iptables_banlist is defined %} {% for obj in iptables_banlist %} {% if obj.proto is defined and obj.destport is defined and obj.sourceport is defined %} -A INPUT -m {{ obj.proto }} -p {{ obj.proto }} -s {{ obj.source }} --sport {{ obj.sourceport }} --dport {{ obj.destport }} -j {{ iptables_banned_default_policy }} {% elif obj.proto is defined and obj.destport is defined %} -A INPUT -m {{ obj.proto }} -p {{ obj.proto }} -s {{ obj.source }} --dport {{ obj.destport }} -j {{ iptables_banned_default_policy }} {% elif obj.proto is defined %} -A INPUT -m {{ obj.proto }} -p {{ obj.proto }} -s {{ obj.source }} -j {{ iptables_banned_default_policy }} {% else %} -A INPUT -s {{ obj.source }} -j {{ iptables_banned_default_policy }} {% endif %} {% endfor %} {% endif %} # Return traffic and localhost -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT # {% if iptables_managed_ssh is defined and iptables_managed_ssh %} {% if iptables_ssh_allowed_hosts is defined %} # ssh is not open to all, even if we use denyhosts to prevent unauthorized accesses {% for ip in iptables_ssh_allowed_hosts %} -A INPUT -m state --state NEW -m tcp -p tcp -s {{ ip }} --dport 22 -j ACCEPT {% endfor %} {% endif %} {% else %} # ssh is always open. We use denyhosts to prevent unauthorized accesses -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT {% endif %} {% if iptables_open_all_to_isti_nets is defined and iptables_open_all_to_isti_nets %} # Permit all traffic from our networks -A INPUT -s {{ network.isti }} -j ACCEPT -A INPUT -s {{ network.nmis }} -j ACCEPT -A INPUT -s {{ network.eduroam }} -j ACCEPT {% endif %} {% if letsencrypt_acme_install is defined and letsencrypt_acme_install %} -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT {% endif %} {% if http_port is defined %} # http {% if http_allowed_hosts is defined %} {% for ip in http_allowed_hosts %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ http_port }} -j ACCEPT {% endfor %} {% else %} -A INPUT -m state --state NEW -m tcp -p tcp --dport {{ http_port }} -j ACCEPT {% endif %} {% endif %} {% if https_port is defined %} # https {% if https_allowed_hosts is defined %} {% for ip in https_allowed_hosts %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ https_port }} -j ACCEPT {% endfor %} {% else %} -A INPUT -m state --state NEW -m tcp -p tcp --dport {{ https_port }} -j ACCEPT {% endif %} {% endif %} {% if psql_firewall_enabled %} {% if psql_db_port is defined %} {% if psql_listen_on_ext_int %} # postgresql clients {% for db in psql_db_data %} {% for ip in db.allowed_hosts %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ psql_db_port }} -j ACCEPT {% endfor %} {% endfor %} {% endif %} -A INPUT -m state --state NEW -s {{ ansible_default_ipv4.address }} -p tcp -m tcp --dport {{ psql_db_port }} -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ psql_db_port }} -j DROP {% endif %} {% endif %} {% if mysql_firewall_enabled %} {% if mysql_db_port is defined %} {% if mysql_listen_on_ext_int %} # mysql clients {% for db in mysql_db_data %} {% for ip in db.allowed_hosts %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ mysql_db_port }} -j ACCEPT {% endfor %} {% endfor %} {% endif %} -A INPUT -m state --state NEW -s {{ ansible_default_ipv4.address }} -p tcp -m tcp --dport {{ mysql_db_port }} -j ACCEPT -A INPUT -p tcp -m tcp --dport {{ mysql_db_port }} -j DROP {% endif %} {% endif %} {% if openldap_slapd_tcp_port is defined %} {% if openldap_allowed_clients is defined %} # LDAP {% for addr in openldap_allowed_clients %} {% if not openldap_slapd_ssl_only %} -A INPUT -m state --state NEW -s {{ addr }} -p tcp -m tcp --dport {{ openldap_slapd_tcp_port }} -j ACCEPT {% endif %} -A INPUT -m state --state NEW -s {{ addr }} -p tcp -m tcp --dport {{ openldap_slapd_ssl_port }} -j ACCEPT {% endfor %} {% else %} {% if not openldap_slapd_ssl_only %} -A INPUT -m state --state NEW -p tcp -m tcp --dport {{ openldap_slapd_tcp_port }} -j ACCEPT {% endif %} -A INPUT -m state --state NEW -p tcp -m tcp --dport {{ openldap_slapd_ssl_port }} -j ACCEPT {% endif %} {% endif %} {% if mongodb_allowed_hosts is defined %} # mongodb clients {% for ip in mongodb_allowed_hosts %} {% if mongodb_tcp_port is defined %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ mongodb_tcp_port }} -j ACCEPT {% else %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport 27017 -j ACCEPT {% endif %} {% endfor %} {% if mongodb_tcp_port is defined %} -A INPUT -p tcp -m tcp --dport {{ mongodb_tcp_port }} -j DROP {% else %} -A INPUT -p tcp -m tcp --dport 27017 -j DROP {% endif %} {% endif %} {% if dnet_ports is defined %} # dnet services {% for tcp_port in dnet_ports %} -A INPUT -m state --state NEW -p tcp -m tcp --dport {{ tcp_port }} -j ACCEPT {% endfor %} {% endif %} {% if dnet_jmx_ports is defined %} # dnet jmx ports. Open to the isti networks only {% for tcp_port in dnet_jmx_ports %} -A INPUT -m state --state NEW -p tcp -m tcp -s {{ network.isti }} --dport {{ tcp_port }} -j ACCEPT -A INPUT -m state --state NEW -p tcp -m tcp -s {{ network.nmis }} --dport {{ tcp_port }} -j ACCEPT -A INPUT -m state --state NEW -p tcp -m tcp -s {{ network.eduroam }} --dport {{ tcp_port }} -j ACCEPT {% endfor %} {% endif %} {% if vsftpd_iptables_rules is defined and vsftpd_iptables_rules %} # Someone still uses ftp {% if vsftpd_iptables_allowed_hosts is defined and vsftpd_iptables_allowed_hosts %} {% for ip in vsftpd_iptables_allowed_hosts %} -A INPUT -m state --state NEW -m tcp -p tcp -s {{ ip }} --dport ftp -j ACCEPT -A INPUT -m state --state NEW,RELATED -m tcp -p tcp -s {{ ip }} --dport {{ vsftpd_pasv_min_port }}:{{ vsftpd_pasv_max_port }} -j ACCEPT {% endfor %} -A INPUT -m helper --helper ftp -j ACCEPT {% endif %} {% endif %} {% if nagios_enabled is defined %} {% if nagios_enabled %} {% if nagios_monitoring_server_ip is defined %} # Nagios NRPE {% for ip in nagios_monitoring_server_ip %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport 5666 -j ACCEPT # Check ntp from the nagios server -A INPUT -s {{ ip }} -p udp -m udp --dport 123 -j ACCEPT {% endfor %} {% endif %} {% endif %} {% endif %} {% if configure_munin is defined %} {% if configure_munin %} {% if munin_server %} # Munin {% for ip in munin_server %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport 4949 -j ACCEPT {% endfor %} {% endif %} {% endif %} {% endif %} {% if tomcat_cluster_enabled %} # tomcat cluster -A INPUT -m pkttype --pkt-type multicast -d {{ tomcat_cluster_multicast_addr }} -j ACCEPT -A INPUT -m state --state NEW -p tcp -m tcp --dport {{ tomcat_cluster_multicast_port }} -j ACCEPT {% endif %} {% if ganglia_enabled is defined %} {% if ganglia_enabled %} {% if ganglia_gmond_cluster_port is defined %} # Ganglia {% if not ganglia_unicast_mode %} {% if ganglia_gmond_use_jmxtrans is not defined or not ganglia_gmond_use_jmxtrans %} -A INPUT -m pkttype --pkt-type multicast -d {{ ganglia_gmond_mcast_addr }} -j ACCEPT {% else %} -A INPUT -m pkttype --pkt-type multicast -j ACCEPT -A INPUT -p udp -m udp -d {{ ganglia_gmond_mcast_addr }} --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT {% endif %} {% else %} {% for net in ganglia_unicast_networks %} -A INPUT -p udp -m udp -s {{ net }} --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT {% endfor %} {% endif %} -A INPUT -m state --state NEW -s {{ ganglia_gmetad_host }} -p tcp -m tcp --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT -A INPUT -s {{ ganglia_gmetad_host }} -p udp -m udp --dport {{ ganglia_gmond_cluster_port }} -j ACCEPT {% endif %} {% endif %} {% endif %} {% if postfix_relay_server is defined %} {% if postfix_relay_server %} # # These are only needed on the machines that act as relay servers # -A INPUT -p tcp -m multiport --dports 25,587,465 -s {{ network.nmis }} -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 25,587,465 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT {% if postfix_use_relay_host is defined and postfix_use_relay_host %} -A OUTPUT -p tcp -m multiport --dports 25,587,465 -m owner --gid-owner postfix -d {{ postfix_relay_host }} -j ACCEPT {% else %} -A OUTPUT -p tcp -m multiport --dports 25,587,465 -m owner --gid-owner postfix -j ACCEPT {% endif %} -A OUTPUT -p tcp -m multiport --dports 25,587,465 -m state --state NEW -j LOG --log-prefix "LOCAL_DROPPED_SPAM " --log-uid -A OUTPUT -p tcp -m multiport --dports 25,587,465 -j DROP {% endif %} {% endif %} {% if postfix_relay_server is defined and not postfix_relay_server %} {% if postfix_relay_client is defined%} {% if postfix_relay_client %} # # When we are not a relay server but we want send email using our relay -A OUTPUT -p tcp -m multiport --dports 25,587,465 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 25,587,465 -m owner --gid-owner postfix -d {{ postfix_relay_host }} -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 25,587,465 -m state --state NEW -j LOG --log-prefix "LOCAL_DROPPED_SPAM " --log-uid -A OUTPUT -p tcp -m multiport --dports 25,587,465 -j DROP {% endif %} {% endif %} {% endif %} {% if iptables is defined %} {% if iptables.tcp_rules is defined and iptables.tcp_rules %} # TCP rules {% for tcp_rule in iptables.tcp %} {% if tcp_rule.allowed_hosts is defined %} {% for ip in tcp_rule.allowed_hosts %} -A INPUT -m state --state NEW -s {{ ip }} -p tcp -m tcp --dport {{ tcp_rule.port }} -j ACCEPT {% endfor %} {% else %} -A INPUT -m state --state NEW -m tcp -p tcp --dport {{ tcp_rule.port }} -j ACCEPT {% endif %} {% endfor %} {% endif %} {% if iptables.udp_rules is defined and iptables.udp_rules %} # UDP rules {% for udp_rule in iptables.udp %} {% if udp_rule.allowed_hosts is defined %} {% for ip in udp_rule.allowed_hosts %} -A INPUT -s {{ ip }} -p udp -m udp --dport {{ udp_rule.port }} -j ACCEPT {% endfor %} {% else %} -A INPUT -p udp -m udp --dport {{ udp_rule.port }} -j ACCEPT {% endif %} {% endfor %} {% endif %} {% endif %} {% if keepalived_enabled is defined and keepalived_enabled %} -A INPUT -p vrrp -d {{ keepalived_mcast_addr }} -j ACCEPT -A OUTPUT -p vrrp -d {{ keepalived_mcast_addr }} -j ACCEPT {% endif %} # -A INPUT -s 125.24.0.0/14 -j DROP {% if iptables_input_default_policy == 'REJECT' %} -A INPUT -j REJECT --reject-with icmp-host-prohibited {% else %} -A INPUT -j {{ iptables_input_default_policy }} {% endif %} {% if not iptables_nat_enabled %} {% if iptables_forward_default_policy == 'REJECT' %} -A FORWARD -j REJECT --reject-with icmp-host-prohibited {% else %} -A FORWARD -j {{ iptables_forward_default_policy }} {% endif %} {% else %} # NAT is enabled, we need to accept traffic that is forwarded -A FORWARD -j ACCEPT {% endif %} COMMIT {% if iptables_nat_enabled %} # NAT rules *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] {% if iptables_nat_specify_interfaces %} {% for int in iptables_nat_interfaces %} -A POSTROUTING -o {{ int }} -j MASQUERADE {% endfor %} {% else %} -A POSTROUTING -j MASQUERADE {% endif %} COMMIT {% endif %}