florian.richer/myserver-configuration
1
0
Fork 0
Code Issues 1 Activity

Begin migration to v2 Step 2

Browse source
This commit is contained in:
Florian RICHER 2024-07-14 22:16:35 +02:00
parent b91292576f
commit a7140e5a84
Signed by: florian.richer
GPG key ID: C73D37CBED7BFC77
37 changed files with 19 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

89
roles/iptables/templates/firewall Executable file
View file

@ -0,0 +1,89 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: firewall rules
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start daemon at boot time
# Description: Enable service provided by daemon.
### END INIT INFO
#Suppression des règles précédentes
/sbin/iptables -F
/sbin/iptables -X
########
# DROP #
########
# Définition du blocage général
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# Drop des scans XMAS et NULL
/sbin/iptables -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
##########
# ACCEPT #
##########
# Conservations des connexions déjà établies
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Autorisation du loopback (127.0.0.1)
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
# Autorisation des échanges avec le serveur DNS (53)
/sbin/iptables -A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p udp -m udp --sport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --sport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
# NTP (123)
/sbin/iptables -A INPUT -p udp --sport 123 -j ACCEPT
/sbin/iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
# HTTP (80)
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
# HTTP MATRIX FEDERATION (8448)
# /sbin/iptables -A INPUT -p tcp --dport 8448 -j ACCEPT
# /sbin/iptables -A OUTPUT -p tcp --dport 8448 -j ACCEPT
# HTTPS (443)
/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
# SSH
/sbin/iptables -A INPUT -p tcp --dport {{ server.ssh_port }} -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ACCEPT SSH INPUT THROUGH TRAEFIK
/sbin/iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT # ACCEPT SSH OUTPUT LIKE GIT
# ICMP (Ping)
/sbin/iptables -A INPUT -p icmp -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp -j ACCEPT
# Parer les attaques de type Déni de Service
/sbin/iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
/sbin/iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
/sbin/iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
# Parer les scans de ports
/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
# Allow all from private network and docker network
/sbin/iptables -A INPUT -j ACCEPT -d 172.17.0.0/16
/sbin/iptables -A OUTPUT -j ACCEPT -d 172.17.0.0/16
/sbin/iptables -A INPUT -j ACCEPT -d 192.168.1.0/24
/sbin/iptables -A OUTPUT -j ACCEPT -d 192.168.1.0/24
# VPN
/sbin/iptables -A INPUT -p udp --dport {{ server.vpn.port }} -j ACCEPT