jcarr
/
wit-network-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

removing pre-defined loopback subnet from firewall dependency

This commit is contained in:
toby 2018-09-09 13:30:30 +02:00
parent 37125104c3
commit 8beb8a5aa9
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
files/firewall
View File

@ -18,14 +18,14 @@ case $1 in
iptables -P INPUT ACCEPT
iptables -F INPUT
#unencrypted traffic
iptables -A INPUT -s 10.1.0.0/16 -p esp -j ACCEPT # ipsec
iptables -A INPUT -s 10.1.0.0/16 -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
iptables -A INPUT -s 10.1.0.0/16 -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
iptables -A INPUT -p esp -j ACCEPT # ipsec
iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
iptables -A INPUT -p icmp -j ACCEPT
#traffic we wanna see from the VPN
iptables -A INPUT -m policy --pol ipsec --dir in -s 10.1.0.0/16 -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -s 10.1.0.0/16 -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration
#iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -s 10.1.0.0/16 -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic
#traffic we want to see encrypted over the VPN
iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration
#iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic
##### DROP the rest
iptables -P INPUT DROP