jcarr
/
wit-network-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
wit-network-config/files/firewall

171 lines
11 KiB
Plaintext
Raw Normal View History

first commit
2018-07-26 03:57:41 -05:00
#!/bin/bash
### BEGIN INIT INFO
# Provides: scriptname
# Required-Start: $network
# Required-Stop: $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: iptables
# Description: Enable firewall rules
### END INIT INFO
exec 1> >(logger -s -t $(basename $0)) 2>&1
case $1 in
start)
echo -n "firewall start..."
### IPv4
iptables -P INPUT ACCEPT
iptables -F INPUT
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## unencrypted traffic
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
iptables -A INPUT -p esp -j ACCEPT # ipsec
orginizing the firewall a little bit, no changes in theory
2018-09-13 05:08:40 -05:00
iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
adding direct ssh access on default for bastion, and migrating to admin domain instead of 3 different zones
2018-10-01 03:38:25 -05:00
iptables -A INPUT -s 170.199.217.0 -p tcp --dport 22 -j ACCEPT # ssh from bastion
adding ipv6 ssh support from bastion (in theory we should actually only need that, but keep ipv4 for now ... just in case)
2018-10-01 08:04:23 -05:00
iptables -A INPUT -s 170.199.217.0 -p udp --sport 53 -j ACCEPT # dns replies from bastion
adding bastion2 to firewalls for potential failover
2018-11-18 17:32:12 -06:00
iptables -A INPUT -s 10.1.19.1 -p tcp --dport 22 -j ACCEPT # ssh from bastion
iptables -A INPUT -s 10.1.19.11 -p tcp --dport 22 -j ACCEPT # ssh from bastion2
adding new firewall rule for stackapi
2018-10-05 17:27:10 -05:00
iptables -A INPUT -s 170.199.216.1 -p tcp --sport 2379 -j ACCEPT # etcd replies stackapi
updated IP for new mirrors in usw2
2018-10-24 16:07:54 -05:00
iptables -A INPUT -s 170.199.216.13 -p tcp --sport 443 -j ACCEPT # mirrors.wit.com
adding smarthost to the firewall
2018-11-13 13:41:41 -06:00
iptables -A INPUT -s 170.199.216.13 -p tcp --sport 25 -j ACCEPT # allow email smart host
adding new firewall rule for stackapi
2018-10-05 17:27:10 -05:00
iptables -A INPUT -i lo -m multiport -p tcp --sports 6800:7300 -j ACCEPT # local ceph traffic
iptables -A INPUT -i lo -m multiport -p tcp --dports 6800:7300 -j ACCEPT # local ceph traffic
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
iptables -A INPUT -p icmp -j ACCEPT
## traffic we want to see encrypted over the VPN
adding first estimated rules for ceph
2018-09-20 09:40:25 -05:00
iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -j ACCEPT # vxlan traffic
adding ceph rgw rules to firewall
2018-11-16 11:26:57 -06:00
iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 8080 -j ACCEPT # ceph rgw traffic
iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --sport 8080 -j ACCEPT # ceph rgw traffic
adding first estimated rules for ceph
2018-09-20 09:40:25 -05:00
iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --dport 6789 -j ACCEPT # ceph mon traffic
iptables -A INPUT -m policy --pol ipsec --dir in -p tcp --sport 6789 -j ACCEPT # ceph mon traffic
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --sports 6800:7300 -j ACCEPT # ceph traffic
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## rules for edge nodes, these should be more specific but for now, it'll do
adding firewall rules for edge boxes
2018-10-20 11:55:45 -05:00
iptables -A INPUT -i up+ -p gre -j ACCEPT # gre tunnels from other sites
iptables -A INPUT -i up+ -p tcp --dport 179 -j ACCEPT # upstream to public bgp
iptables -A INPUT -i up+ -p tcp --sport 179 -j ACCEPT # upstream from public bgp
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
### mgmt
iptables -A INPUT -i mgmt -p tcp --dport 22 -j ACCEPT
orginizing the firewall a little bit, no changes in theory
2018-09-13 05:08:40 -05:00
iptables -A INPUT -i mgmt -m state --state ESTABLISHED,RELATED -j ACCEPT
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
### DROP the rest
first commit
2018-07-26 03:57:41 -05:00
iptables -P INPUT DROP
adding bastion firewall rules to all firewalls. this is precausion so that we have the blocking rules in any event. the rest of bastion gets deployed through ansible but since if ansible gets forgotton or other things happen this will make sure the most critical things are there
2018-11-04 14:13:13 -06:00
## some rules for bastion boxes to protect the mgmt networks
iptables -F FORWARD
iptables -A FORWARD -o mgmtgw1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o mgmtgw1 -j DROP
iptables -A FORWARD -i ipmigw1 -j DROP
iptables -A FORWARD -o ipmigw1 -j DROP
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
#special tables
iptables -t mangle -F
iptables -t nat -F
iptables -t raw -F
adding bastion firewall rules to all firewalls. this is precausion so that we have the blocking rules in any event. the rest of bastion gets deployed through ansible but since if ansible gets forgotton or other things happen this will make sure the most critical things are there
2018-11-04 14:13:13 -06:00
# this matters only on bastion boxes
iptables -t raw -A PREROUTING -i mgmtgw1 -j ACCEPT
iptables -t raw -A OUTPUT -o mgmtgw1 -j ACCEPT
iptables -t raw -A PREROUTING -i ipmigw1 -j ACCEPT
iptables -t raw -A OUTPUT -o ipmigw1 -j ACCEPT
# this matters on all boxes
simplifying and adding flexibility to the NOTRACK rules
2018-11-04 13:19:09 -06:00
iptables -t raw -A PREROUTING -i mgmt1 -j ACCEPT
iptables -t raw -A OUTPUT -o mgmt -j ACCEPT
iptables -t raw -A PREROUTING -j NOTRACK
iptables -t raw -A OUTPUT -j NOTRACK
orginizing the firewall a little bit, no changes in theory
2018-09-12 18:17:40 -05:00
first commit
2018-07-26 03:57:41 -05:00
#### IPv6
ip6tables -P INPUT ACCEPT
ip6tables -F INPUT
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## unencrypted traffic
adding ipv6 tunnel to strongswan and matching firewall rules
2018-09-17 14:28:02 -05:00
ip6tables -A INPUT -p esp -j ACCEPT # ipsec
ip6tables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
ip6tables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT # ping
typo in firewall rule
2018-10-01 11:25:50 -05:00
ip6tables -A INPUT -s 2604:bbc0:0:113::1 -p tcp --dport 22 -j ACCEPT # ssh from bastion
adding ipv6 ssh support from bastion (in theory we should actually only need that, but keep ipv4 for now ... just in case)
2018-10-01 08:04:23 -05:00
ip6tables -A INPUT -s 2604:bbc0:0:113::1 -p udp --sport 53 -j ACCEPT # dns replies from bastion
adding bastion2 to firewalls for potential failover
2018-11-18 17:32:12 -06:00
ip6tables -A INPUT -s 2604:bbc0:0:113::b -p tcp --dport 22 -j ACCEPT # ssh from bastion2
ip6tables -A INPUT -s 2604:bbc0:0:113::b -p udp --sport 53 -j ACCEPT # dns replies from bastion2
adding ipv6 tunnel to strongswan and matching firewall rules
2018-09-17 14:28:02 -05:00
ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT # ntp
ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT # ntp
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
ip6tables -A INPUT -s fe80::/10 -i feth+ -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s fe80::/10 -i feth+ -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding)
fixing live migration iptables rules
2018-11-16 19:06:37 -06:00
## traffic we want to see encrypted over the VPN
ip6tables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration
ip6tables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --sports 49152:49215 -j ACCEPT # libvirt live migration
cleanup firewall rules and making unnumbered bgp rules a tad more restrictive
2018-10-21 16:08:58 -05:00
## rules for edge nodes, these should be more specific but for now, it'll do
ip6tables -A INPUT -s fe80::/10 -i gre+ -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s fe80::/10 -i gre+ -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding)
adding firewall rules for edge boxes
2018-10-20 11:55:45 -05:00
ip6tables -A INPUT -i up+ -p tcp --dport 179 -j ACCEPT # bgp to public peer
ip6tables -A INPUT -i up+ -p tcp --sport 179 -j ACCEPT # bgp from public peer
fixing DHCP6 offer packets on firewall to come through
2018-09-09 16:37:24 -05:00
### mgmt
adding ipv6 tunnel to strongswan and matching firewall rules
2018-09-17 14:28:02 -05:00
ip6tables -A INPUT -i mgmt1 -s fe80::/10 -p udp --dport 546 -j ACCEPT # allow dhcp replys, unlcear why this needs the physical interface instead of the vrf
ip6tables -A INPUT -i mgmt -p tcp --dport 22 -j ACCEPT # allow ssh from mgmt
ip6tables -A INPUT -i mgmt -m state --state ESTABLISHED,RELATED -j ACCEPT # allow stateful connections over mgmt
first commit
2018-07-26 03:57:41 -05:00
### DROP the rest
ip6tables -P INPUT DROP
adding bastion firewall rules to all firewalls. this is precausion so that we have the blocking rules in any event. the rest of bastion gets deployed through ansible but since if ansible gets forgotton or other things happen this will make sure the most critical things are there
2018-11-04 14:13:13 -06:00
## some rules for bastion boxes to protect the mgmt networks
ip6tables -F FORWARD
ip6tables -A FORWARD -o mgmtgw1 -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A FORWARD -o mgmtgw1 -j DROP
ip6tables -A FORWARD -i ipmigw1 -j DROP
ip6tables -A FORWARD -o ipmigw1 -j DROP
first commit
2018-07-26 03:57:41 -05:00
#special tables
ip6tables -t mangle -F
ip6tables -t nat -F
ip6tables -t raw -F
adding bastion firewall rules to all firewalls. this is precausion so that we have the blocking rules in any event. the rest of bastion gets deployed through ansible but since if ansible gets forgotton or other things happen this will make sure the most critical things are there
2018-11-04 14:13:13 -06:00
# this matters only on bastion boxes
ip6tables -t raw -A PREROUTING -i mgmtgw1 -j ACCEPT
ip6tables -t raw -A OUTPUT -o mgmtgw1 -j ACCEPT
ip6tables -t raw -A PREROUTING -i ipmigw1 -j ACCEPT
ip6tables -t raw -A OUTPUT -o ipmigw1 -j ACCEPT
# this matters on all boxes
ip6tables -t raw -A PREROUTING -i mgmt1 -j ACCEPT
ip6tables -t raw -A OUTPUT -o mgmt -j ACCEPT
ip6tables -t raw -A PREROUTING -j NOTRACK
ip6tables -t raw -A OUTPUT -j NOTRACK
first commit
2018-07-26 03:57:41 -05:00
simplifying and adding flexibility to the NOTRACK rules
2018-11-04 13:19:09 -06:00
#some boxes get special addon rules
[ -e /etc/init.d/firewall-addon ] && source /etc/init.d/firewall-addon
first commit
2018-07-26 03:57:41 -05:00
;;
stop)
echo -n "firewall stop..."
#### Firewall rules
iptables -P INPUT ACCEPT
iptables -F
iptables -t raw -F
iptables -t nat -F
iptables -t mangle -F
ip6tables -P INPUT ACCEPT
ip6tables -F
ip6tables -t raw -F
ip6tables -t nat -F
ip6tables -t mangle -F
echo " done"
;;
restart)
#$0 stop
$0 start
;;
*)
echo "use $0 [start|stop|restart]"
;;
esac
fixng small console error so that systemd actually thinks firewall started successfully
2018-11-12 14:08:25 -06:00
exit 0