From 8beb8a5aa9fadc8e7d9086aeb2243ca2464fecd1 Mon Sep 17 00:00:00 2001 From: toby Date: Sun, 9 Sep 2018 13:30:30 +0200 Subject: [PATCH] removing pre-defined loopback subnet from firewall dependency --- files/firewall | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/files/firewall b/files/firewall index 8fc9785..b8602f4 100755 --- a/files/firewall +++ b/files/firewall @@ -18,14 +18,14 @@ case $1 in iptables -P INPUT ACCEPT iptables -F INPUT #unencrypted traffic - iptables -A INPUT -s 10.1.0.0/16 -p esp -j ACCEPT # ipsec - iptables -A INPUT -s 10.1.0.0/16 -p udp --dport 500 --sport 500 -j ACCEPT # ipsec - iptables -A INPUT -s 10.1.0.0/16 -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec + iptables -A INPUT -p esp -j ACCEPT # ipsec + iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec + iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec iptables -A INPUT -p icmp -j ACCEPT - #traffic we wanna see from the VPN - iptables -A INPUT -m policy --pol ipsec --dir in -s 10.1.0.0/16 -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic - iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -s 10.1.0.0/16 -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration - #iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -s 10.1.0.0/16 -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic + #traffic we want to see encrypted over the VPN + iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic + iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration + #iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic ##### DROP the rest iptables -P INPUT DROP