Skip to content

Commit

Permalink
Merge pull request #371 from iotaledger/fix/feature-firewall
Browse files Browse the repository at this point in the history
Actually firewall docker forward rules
  • Loading branch information
karimodm authored Sep 27, 2023
2 parents d4aa80b + 4f60ba4 commit 6f07e17
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 0 deletions.
27 changes: 27 additions & 0 deletions deploy/ansible/roles/firewall/files/after.rules
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# BEGIN UFW AND DOCKER
*filter
:ufw-user-forward - [0:0]
:ufw-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw-user-forward

-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16

-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN

-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12

-A DOCKER-USER -j RETURN

-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw-docker-logging-deny -j DROP

COMMIT
# END UFW AND DOCKER
7 changes: 7 additions & 0 deletions deploy/ansible/roles/firewall/tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,13 @@
ufw:
state: reset

- name: Ensure content from source file is at the end of the config file
blockinfile:
path: /etc/ufw/after.rules
marker: "# {mark} ANSIBLE MANAGED BLOCK FOR CONFIG END"
block: "{{ lookup('file', 'after.rules') }}"
insertafter: EOF

- name: Allow ssh
ufw:
rule: allow
Expand Down

0 comments on commit 6f07e17

Please sign in to comment.