From 4f60ba4aefc76634d6920e9cc7dd554b04125f67 Mon Sep 17 00:00:00 2001
From: Andrea V <1577639+karimodm@users.noreply.github.com>
Date: Wed, 27 Sep 2023 12:10:15 +0200
Subject: [PATCH] Actually firewall docker forward rules

---
 .../ansible/roles/firewall/files/after.rules  | 27 +++++++++++++++++++
 deploy/ansible/roles/firewall/tasks/main.yml  |  7 +++++
 2 files changed, 34 insertions(+)
 create mode 100644 deploy/ansible/roles/firewall/files/after.rules

diff --git a/deploy/ansible/roles/firewall/files/after.rules b/deploy/ansible/roles/firewall/files/after.rules
new file mode 100644
index 000000000..2d4d07081
--- /dev/null
+++ b/deploy/ansible/roles/firewall/files/after.rules
@@ -0,0 +1,27 @@
+# BEGIN UFW AND DOCKER
+*filter
+:ufw-user-forward - [0:0]
+:ufw-docker-logging-deny - [0:0]
+:DOCKER-USER - [0:0]
+-A DOCKER-USER -j ufw-user-forward
+
+-A DOCKER-USER -j RETURN -s 10.0.0.0/8
+-A DOCKER-USER -j RETURN -s 172.16.0.0/12
+-A DOCKER-USER -j RETURN -s 192.168.0.0/16
+
+-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN
+
+-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
+-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
+-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
+-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
+-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
+-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
+
+-A DOCKER-USER -j RETURN
+
+-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
+-A ufw-docker-logging-deny -j DROP
+
+COMMIT
+# END UFW AND DOCKER
\ No newline at end of file
diff --git a/deploy/ansible/roles/firewall/tasks/main.yml b/deploy/ansible/roles/firewall/tasks/main.yml
index 6e0214bca..83c48e165 100644
--- a/deploy/ansible/roles/firewall/tasks/main.yml
+++ b/deploy/ansible/roles/firewall/tasks/main.yml
@@ -7,6 +7,13 @@
   ufw:
     state: reset
 
+- name: Ensure content from source file is at the end of the config file
+  blockinfile:
+    path: /etc/ufw/after.rules
+    marker: "# {mark} ANSIBLE MANAGED BLOCK FOR CONFIG END"
+    block: "{{ lookup('file', 'after.rules') }}"
+    insertafter: EOF
+
 - name: Allow ssh
   ufw:
     rule: allow