jcarr
/
wit-network-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
wit-network-config/files/firewall

130 lines
8.0 KiB
Plaintext
Raw Normal View History

first commit
2018-07-26 03:57:41 -05:00
#!/bin/bash
### BEGIN INIT INFO
# Provides: scriptname
# Required-Start: $network
# Required-Stop: $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: iptables
# Description: Enable firewall rules
### END INIT INFO
exec 1> >(logger -s -t $(basename $0)) 2>&1
case $1 in
start)
echo -n "firewall start..."
### IPv4
iptables -P INPUT ACCEPT
iptables -F INPUT
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## unencrypted traffic
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
iptables -A INPUT -p esp -j ACCEPT # ipsec
orginizing the firewall a little bit, no changes in theory
2018-09-13 05:08:40 -05:00
iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
adding direct ssh access on default for bastion, and migrating to admin domain instead of 3 different zones
2018-10-01 03:38:25 -05:00
iptables -A INPUT -s 170.199.217.0 -p tcp --dport 22 -j ACCEPT # ssh from bastion
adding ipv6 ssh support from bastion (in theory we should actually only need that, but keep ipv4 for now ... just in case)
2018-10-01 08:04:23 -05:00
iptables -A INPUT -s 170.199.217.0 -p udp --sport 53 -j ACCEPT # dns replies from bastion
adding new firewall rule for stackapi
2018-10-05 17:27:10 -05:00
iptables -A INPUT -s 170.199.216.1 -p tcp --sport 2379 -j ACCEPT # etcd replies stackapi
updated IP for new mirrors in usw2
2018-10-24 16:07:54 -05:00
iptables -A INPUT -s 170.199.216.13 -p tcp --sport 443 -j ACCEPT # mirrors.wit.com
adding new firewall rule for stackapi
2018-10-05 17:27:10 -05:00
iptables -A INPUT -i lo -m multiport -p tcp --sports 6800:7300 -j ACCEPT # local ceph traffic
iptables -A INPUT -i lo -m multiport -p tcp --dports 6800:7300 -j ACCEPT # local ceph traffic
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
iptables -A INPUT -p icmp -j ACCEPT
## traffic we want to see encrypted over the VPN
adding first estimated rules for ceph
2018-09-20 09:40:25 -05:00
iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -j ACCEPT # vxlan traffic
iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 6789 -j ACCEPT # ceph mon traffic
iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --sport 6789 -j ACCEPT # ceph mon traffic
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --sports 6800:7300 -j ACCEPT # ceph traffic
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## rules for edge nodes, these should be more specific but for now, it'll do
adding firewall rules for edge boxes
2018-10-20 11:55:45 -05:00
iptables -A INPUT -i up+ -p gre -j ACCEPT # gre tunnels from other sites
iptables -A INPUT -i up+ -p tcp --dport 179 -j ACCEPT # upstream to public bgp
iptables -A INPUT -i up+ -p tcp --sport 179 -j ACCEPT # upstream from public bgp
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
### mgmt
iptables -A INPUT -i mgmt -p tcp --dport 22 -j ACCEPT
orginizing the firewall a little bit, no changes in theory
2018-09-13 05:08:40 -05:00
iptables -A INPUT -i mgmt -m state --state ESTABLISHED,RELATED -j ACCEPT
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
### DROP the rest
first commit
2018-07-26 03:57:41 -05:00
iptables -P INPUT DROP
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
#special tables
iptables -t mangle -F
iptables -t nat -F
iptables -t raw -F
simplifying and adding flexibility to the NOTRACK rules
2018-11-04 13:19:09 -06:00
iptables -t raw -A PREROUTING -i mgmt1 -j ACCEPT
iptables -t raw -A OUTPUT -o mgmt -j ACCEPT
iptables -t raw -A PREROUTING -j NOTRACK
iptables -t raw -A OUTPUT -j NOTRACK
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
first commit
2018-07-26 03:57:41 -05:00
#### IPv6
ip6tables -P INPUT ACCEPT
ip6tables -F INPUT
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## unencrypted traffic
adding ipv6 tunnel to strongswan and matching firewall rules
2018-09-17 14:28:02 -05:00
ip6tables -A INPUT -p esp -j ACCEPT # ipsec
ip6tables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
ip6tables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT # ping
typo in firewall rule
2018-10-01 11:25:50 -05:00
ip6tables -A INPUT -s 2604:bbc0:0:113::1 -p tcp --dport 22 -j ACCEPT # ssh from bastion
adding ipv6 ssh support from bastion (in theory we should actually only need that, but keep ipv4 for now ... just in case)
2018-10-01 08:04:23 -05:00
ip6tables -A INPUT -s 2604:bbc0:0:113::1 -p udp --sport 53 -j ACCEPT # dns replies from bastion
adding ipv6 tunnel to strongswan and matching firewall rules
2018-09-17 14:28:02 -05:00
ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT # ntp
ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT # ntp
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
ip6tables -A INPUT -s fe80::/10 -i feth+ -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s fe80::/10 -i feth+ -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding)
## rules for edge nodes, these should be more specific but for now, it'll do
ip6tables -A INPUT -s fe80::/10 -i gre+ -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s fe80::/10 -i gre+ -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding)
adding firewall rules for edge boxes
2018-10-20 11:55:45 -05:00
ip6tables -A INPUT -i up+ -p tcp --dport 179 -j ACCEPT # bgp to public peer
ip6tables -A INPUT -i up+ -p tcp --sport 179 -j ACCEPT # bgp from public peer
fixing DHCP6 offer packets on firewall to come through
2018-09-09 16:37:24 -05:00
### mgmt
adding ipv6 tunnel to strongswan and matching firewall rules
2018-09-17 14:28:02 -05:00
ip6tables -A INPUT -i mgmt1 -s fe80::/10 -p udp --dport 546 -j ACCEPT # allow dhcp replys, unlcear why this needs the physical interface instead of the vrf
ip6tables -A INPUT -i mgmt -p tcp --dport 22 -j ACCEPT # allow ssh from mgmt
ip6tables -A INPUT -i mgmt -m state --state ESTABLISHED,RELATED -j ACCEPT # allow stateful connections over mgmt
first commit
2018-07-26 03:57:41 -05:00
### DROP the rest
ip6tables -P INPUT DROP
#special tables
ip6tables -t mangle -F
ip6tables -t nat -F
ip6tables -t raw -F
simplifying and adding flexibility to the NOTRACK rules
2018-11-04 13:19:09 -06:00
ip6tables -t raw -A PREROUTING -i mgmt1 -j ACCEPT
ip6tables -t raw -A OUTPUT -o mgmt -j ACCEPT
ip6tables -t raw -A PREROUTING -j NOTRACK
ip6tables -t raw -A OUTPUT -j NOTRACK
first commit
2018-07-26 03:57:41 -05:00
simplifying and adding flexibility to the NOTRACK rules
2018-11-04 13:19:09 -06:00
#some boxes get special addon rules
[ -e /etc/init.d/firewall-addon ] && source /etc/init.d/firewall-addon
first commit
2018-07-26 03:57:41 -05:00
;;
stop)
echo -n "firewall stop..."
#### Firewall rules
iptables -P INPUT ACCEPT
iptables -F
iptables -t raw -F
iptables -t nat -F
iptables -t mangle -F
ip6tables -P INPUT ACCEPT
ip6tables -F
ip6tables -t raw -F
ip6tables -t nat -F
ip6tables -t mangle -F
echo " done"
;;
restart)
#$0 stop
$0 start
;;
*)
echo "use $0 [start|stop|restart]"
;;
esac