diff options
| -rw-r--r--[-rwxr-xr-x] | roles/space_server/files/nftables/nftables.conf | 169 | ||||
| -rw-r--r-- | roles/space_server/tasks/nftables.yml | 10 |
2 files changed, 70 insertions, 109 deletions
diff --git a/roles/space_server/files/nftables/nftables.conf b/roles/space_server/files/nftables/nftables.conf index c9dc9d7..619d776 100755..100644 --- a/roles/space_server/files/nftables/nftables.conf +++ b/roles/space_server/files/nftables/nftables.conf @@ -1,5 +1,3 @@ -#!/usr/sbin/nft -f - # our hosts define ap1 = 10.42.0.5 define ap2 = 10.42.0.6 @@ -35,6 +33,7 @@ define priv_net6 = 2a01:4260:1ab:c::/64 define free_if = lan13 define free_ip4 = 10.42.3.1 define free_net4 = 10.42.3.0/24 +define free_net6 = 2a01:4260:1ab:d::/64 define pass_if = lan14 define pass_ip4 = 10.42.4.1 @@ -65,31 +64,34 @@ table ip filter { iif lo accept - # infrastructure - iif $ext_if ip saddr $link_net4 ip daddr $link_net4 counter accept - udp sport bootpc udp dport bootps iif != $ext_if counter accept # DHCP requests - iif $adm_if ip saddr { $ap1, $ap2 } udp dport 1812 accept # RADIUS from AP - iif $ext_if ip saddr $labitat ip protocol 41 accept # IPv6 tunnel - iif $wire_if ip saddr $wire_net4 udp dport 69 accept # TFTP - iif $wire_if ip saddr $wire_net4 udp dport 123 accept # NTP + # bird etc. on fiberby link + iif $ext_if ip saddr $link_net4 ip daddr $link_net4 counter accept + + # dhcp + udp sport bootpc udp dport bootps iif != $ext_if counter accept + + # radius + iif $adm_if ip saddr { $ap1, $ap2 } udp dport 1812 accept + + # tftp + iif $wire_if ip saddr $wire_net4 udp dport 69 accept - # allow ssh + # ssh tcp dport 22 accept # dns - ip saddr $int_net4 tcp dport 53 accept - ip saddr $int_net4 udp dport 53 accept - ip saddr $ext_net4 tcp dport 53 accept - ip saddr $ext_net4 udp dport 53 accept + tcp dport 53 ip saddr { $int_net4, $ext_net4 } accept + udp dport 53 ip saddr { $int_net4, $ext_net4 } accept - # Avahi + # avahi ip daddr 224.0.0.251 udp dport 5353 iif $avahi_ifs accept - ip protocol igmp iif $avahi_ifs accept # Allow IGMP here + ip protocol igmp iif $avahi_ifs accept - iif $ext_if counter drop - udp dport { 137, 138, 5353 } drop # NetBIOS, Avahi - udp sport 17500 udp dport 17500 drop # Dropbox LANsync - ip protocol igmp drop # IGMP + ## debugging + #iif $ext_if counter drop + #udp dport { 137, 138, 5353, 27036 } drop # NetBIOS, Avahi, Steam in-home stream + #udp sport 17500 udp dport 17500 drop # Dropbox LANsync + #ip protocol igmp drop # IGMP #counter log prefix "in4: " drop drop } @@ -100,16 +102,14 @@ table ip filter { ct state established,related accept ct state invalid drop - # no ping floods - ip protocol icmp limit rate 100/second accept - ip protocol icmp drop - - ip daddr $spacewand4 accept - ip saddr $labitat udp dport 161 counter accept # traffic stats # no traffic to admin net - ip saddr $int_net4 ip daddr $adm_net4 drop + ip daddr $adm_net4 ip saddr $int_net4 reject with icmp type net-prohibited + ip daddr $adm_net4 drop + + # accept all traffic to spacewand + ip daddr $spacewand4 accept # local traffic iif $adm_if ip saddr $adm_net4 accept @@ -119,37 +119,13 @@ table ip filter { iif $pass_if ip saddr $pass_net4 accept iif $serv_if ip saddr $serv_net4 accept + ## debugging + #iif $ext_if counter drop #counter log prefix "fw4: " drop drop } } -table ip nat { - chain portforward { - ip daddr $ext_ip4 udp dport 161 dnat 10.42.0.9 # traffic stats - } - - chain prerouting { - type nat hook prerouting priority -150; - goto portforward - } - - chain output { - type nat hook output priority -150; - goto portforward - } - - chain input { - type nat hook input priority -150; - # this chain is needed to make dnat from the output chain work - } - - chain postrouting { - type nat hook postrouting priority -150; - oif $ext_if snat $ext_ip4 - } -} - table ip6 filter { chain input { type filter hook input priority 0; @@ -158,20 +134,22 @@ table ip6 filter { ct state invalid drop # no ping floods - ip6 nexthdr icmpv6 limit rate 100/second accept - ip6 nexthdr icmpv6 drop + ip6 nexthdr { hopopt, ipv6-icmp } limit rate 100/second accept + ip6 nexthdr { hopopt, ipv6-icmp } drop iif lo accept + # bird etc. on fiberby link iif $ext_if ip6 saddr $link_net6 ip6 daddr $link_net6 counter accept - # allow ssh + # ssh tcp dport 22 accept # dns ip6 saddr $ext_net6 tcp dport 53 accept ip6 saddr $ext_net6 udp dport 53 accept + ## debugging #counter log prefix "in6: " drop drop } @@ -182,67 +160,42 @@ table ip6 filter { ct state established,related accept ct state invalid drop - # no ping floods - ip6 nexthdr icmpv6 limit rate 100/second accept - ip6 nexthdr icmpv6 drop - ip6 daddr $spacewand6 accept iif $wire_if ip6 saddr $wire_net6 accept iif $priv_if ip6 saddr $priv_net6 accept + #iif $free_if ip6 saddr $free_net6 ip6 daddr != $int_net6 accept iif $pass_if ip6 saddr $pass_net6 accept iif $serv_if ip6 saddr $serv_net6 accept + ## debugging #counter log prefix "fw6: " drop drop } } -# Allow all by default -# (couldn't get default-deny to work, and this script is better than nothing) - -#table ip6 filter { -# chain input { -# type filter hook input priority 0; -# # Don't allow ULA net on outside -# #ip6tables -A INPUT -j REJECT -i $ext_if6 -d $ula_net -# iif $ext_if6 ip6 daddr $ula_net reject -# #ip6tables -A INPUT -j REJECT -i $ext_if6 -s $ula_net -# iif $ext_if6 ip6 saddr $ula_net reject -# -# accept -# } -# -# chain output { -# type filter hook output priority 0; -# #ip6tables -A OUTPUT -j REJECT -o $ext_if6 -d $ula_net -# oif $ext_if6 ip6 daddr $ula_net reject -# #ip6tables -A OUTPUT -j REJECT -o $ext_if6 -s $ula_net -# oif $ext_if6 ip6 saddr $ula_net reject -# -# accept -# } -# -# chain forward { -# type filter hook forward priority 0; -# # Don't allow NAT64 for networks with IPv4 -# # (remember: free and admin don't have IPv6) -# #ip6tables -A FORWARD -j REJECT -i $wire_if -d $nat64_net6 -# iif $wire_if ip6 daddr $nat64_net6 reject -# #ip6tables -A FORWARD -j REJECT -i $priv_if -d $nat64_net6 -# iif $priv_if ip6 daddr $nat64_net6 reject -# #ip6tables -A FORWARD -j REJECT -i $pass_if -d $nat64_net6 -# iif $pass_if ip6 daddr $nat64_net6 reject -# -# #ip6tables -A FORWARD -j REJECT -i $ext_if6 -d $ula_net -# iif $ext_if6 ip6 daddr $ula_net reject -# #ip6tables -A FORWARD -j REJECT -i $ext_if6 -s $ula_net -# iif $ext_if6 ip6 saddr $ula_net reject -# #ip6tables -A FORWARD -j REJECT -o $ext_if6 -d $ula_net -# oif $ext_if6 ip6 daddr $ula_net reject -# #ip6tables -A FORWARD -j REJECT -o $ext_if6 -s $ula_net -# oif $ext_if6 ip6 saddr $ula_net reject -# -# accept -# } -#} +table ip nat { + chain portforward { + ip daddr $ext_ip4 udp dport 161 dnat 10.42.0.9 # traffic stats + } + + chain prerouting { + type nat hook prerouting priority -150; + goto portforward + } + + chain output { + type nat hook output priority -150; + goto portforward + } + + chain input { + type nat hook input priority -150; + # this chain is needed to make dnat from the output chain work + } + + chain postrouting { + type nat hook postrouting priority -150; + oif $ext_if snat $ext_ip4 + } +} diff --git a/roles/space_server/tasks/nftables.yml b/roles/space_server/tasks/nftables.yml index a7fb588..2dc8fce 100644 --- a/roles/space_server/tasks/nftables.yml +++ b/roles/space_server/tasks/nftables.yml @@ -11,10 +11,18 @@ tags: - packages +- name: Symlink to /etc/nftables.conf + file: + path: '/etc/sysconfig/nftables.conf' + state: link + src: '../nftables.conf' + force: yes + notify: + - reload nftables - name: Configure nftables copy: src: nftables/nftables.conf - dest: '/etc/sysconfig/nftables.conf' + dest: '/etc/nftables.conf' notify: - reload nftables |