diff options
| author | Trygve Laugstøl <trygvis@inamo.no> | 2019-01-06 15:43:45 +0100 |
|---|---|---|
| committer | Trygve Laugstøl <trygvis@inamo.no> | 2019-01-06 15:43:45 +0100 |
| commit | 67e8a83408c0e5b03ca4f8189f00092cb63b65d5 (patch) | |
| tree | e4982c56707b812760301af94c7d0d12ec7a56ac | |
| parent | 3572c448f189d451dab80933fc4f78980999acd6 (diff) | |
| download | infra-67e8a83408c0e5b03ca4f8189f00092cb63b65d5.tar.gz infra-67e8a83408c0e5b03ca4f8189f00092cb63b65d5.tar.bz2 infra-67e8a83408c0e5b03ca4f8189f00092cb63b65d5.tar.xz infra-67e8a83408c0e5b03ca4f8189f00092cb63b65d5.zip | |
o Switching arius from UFW to nftables.
| -rw-r--r-- | .gitmodules | 3 | ||||
| -rw-r--r-- | ansible/all.yml | 4 | ||||
| -rw-r--r-- | ansible/host_vars/arius/nftables.yml | 45 | ||||
| -rw-r--r-- | ansible/nftables.yml | 15 | ||||
| m--------- | ansible/thirdparty/nftables | 0 |
5 files changed, 66 insertions, 1 deletions
diff --git a/.gitmodules b/.gitmodules index 49861e4..0d8ea02 100644 --- a/.gitmodules +++ b/.gitmodules @@ -7,3 +7,6 @@ [submodule "ansible/thirdparty/ansible-elasticsearch"] path = ansible/thirdparty/ansible-elasticsearch url = https://github.com/elastic/ansible-elasticsearch +[submodule "ansible/thirdparty/nftables"] + path = ansible/thirdparty/nftables + url = https://github.com/Frzk/ansible-role-nftables diff --git a/ansible/all.yml b/ansible/all.yml index 6898a27..4e6de9e 100644 --- a/ansible/all.yml +++ b/ansible/all.yml @@ -5,7 +5,9 @@ - superusers - packages - trygvis-base - - ufw +# - ufw + +- import_playbook: nftables.yml - hosts: - knot diff --git a/ansible/host_vars/arius/nftables.yml b/ansible/host_vars/arius/nftables.yml new file mode 100644 index 0000000..6f4f167 --- /dev/null +++ b/ansible/host_vars/arius/nftables.yml @@ -0,0 +1,45 @@ +allowed_services: + - ssh + - http + - https + +nftables_tables: + - name: firewall + family: inet + chains: + - name: "input" + base: + type: "filter" + hook: "input" + priority: 0 + policy: "drop" + rules: + - position: 1 + statement: "iif lo accept" + - position: 2 + statement: 'ct state invalid log prefix "FW:DROP:" drop' + comment: "Log and drop invalid packets." + - position: 3 + statement: "ct state established,related accept" + - position: 10 + statement: "ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit,echo-request,nd-router-advert,nd-neighbor-advert} accept" + - position: 11 + statement: "tcp dport {{ '{' + ', '.join(allowed_services) }}} accept" + + - name: "forward" + base: + type: "filter" + hook: "forward" + priority: 0 + policy: "accept" + + - name: "output" + base: + type: "filter" + hook: "output" + priority: 0 + policy: "accept" + rules: + - position: 1 + statement: "" +# statement: "ip daddr 192.0.2.100 counter" diff --git a/ansible/nftables.yml b/ansible/nftables.yml new file mode 100644 index 0000000..72f98df --- /dev/null +++ b/ansible/nftables.yml @@ -0,0 +1,15 @@ +- hosts: + - arius + tasks: + - name: Remove UFW + become: yes + apt: + name: ufw + state: absent + purge: yes + +- hosts: + - arius + roles: + - role: nftables + become: yes diff --git a/ansible/thirdparty/nftables b/ansible/thirdparty/nftables new file mode 160000 +Subproject 4deac341eb193843f7641a58d68ab90bcc50723 |