feat(roles/security): extendend nftables config
This commit is contained in:
@@ -1,38 +1,300 @@
|
||||
#!/usr/sbin/nft -f
|
||||
#
|
||||
# Managed by Ansible — manual changes will be overwritten on next deployment
|
||||
#
|
||||
|
||||
table inet filter {
|
||||
{% set default_policy = security_firewall_default_policy | default('drop') %}
|
||||
{% set allowed_ports = security_firewall_allowed_ports | default([]) %}
|
||||
{% set trusted_interfaces = security_nftables_trusted_interfaces | default(['lo']) %}
|
||||
{% set rate_limit_enabled = security_nftables_rate_limit_enabled | default(true) %}
|
||||
{% set icmp_rate = security_nftables_icmp_rate | default('10/second') %}
|
||||
{% set ct_rate = security_nftables_new_conn_rate | default('100/second') %}
|
||||
{% set ct_rate_burst = security_nftables_new_conn_burst | default(50) %}
|
||||
{% set log_dropped = security_nftables_log_dropped | default(false) %}
|
||||
{% set log_prefix = security_nftables_log_prefix | default('nftables-dropped: ') %}
|
||||
{% set custom_input_rules = security_nftables_custom_input_rules | default([]) %}
|
||||
{% set custom_forward_rules = security_nftables_custom_forward_rules | default([]) %}
|
||||
{% set custom_output_rules = security_nftables_custom_output_rules | default([]) %}
|
||||
{% set dnat_rules = security_nftables_dnat_rules | default([]) %}
|
||||
{% set snat_rules = security_nftables_snat_rules | default([]) %}
|
||||
{% set masquerade_interfaces = security_nftables_masquerade_interfaces | default([]) %}
|
||||
{% set custom_raw = security_nftables_custom_config | default('') %}
|
||||
{% set forward_policy = security_nftables_forward_policy | default('accept') %}
|
||||
{% set output_policy = security_nftables_output_policy | default('accept') %}
|
||||
{% set blocked_ips = security_nftables_blocked_ips | default([]) %}
|
||||
{% set trusted_ips = security_nftables_trusted_ips | default([]) %}
|
||||
{% set allowed_port_ranges = security_nftables_allowed_port_ranges | default([]) %}
|
||||
|
||||
{% set blocked_v4 = blocked_ips | select('match', '.*\\..*') | list %}
|
||||
{% set blocked_v6 = blocked_ips | reject('match', '.*\\..*') | list %}
|
||||
{% set trusted_v4 = trusted_ips | select('match', '.*\\..*') | list %}
|
||||
{% set trusted_v6 = trusted_ips | reject('match', '.*\\..*') | list %}
|
||||
|
||||
{% set has_nat = (dnat_rules | length > 0) or (snat_rules | length > 0) or (masquerade_interfaces | length > 0) %}
|
||||
|
||||
table inet ansible_filter
|
||||
delete table inet ansible_filter
|
||||
|
||||
# Always attempt to delete the NAT table so stale rules don't survive
|
||||
# when all NAT variables are removed from host_vars.
|
||||
table ip ansible_nat
|
||||
delete table ip ansible_nat
|
||||
|
||||
table inet ansible_filter {
|
||||
|
||||
{% if blocked_v4 | length > 0 %}
|
||||
set blocked_v4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = {
|
||||
{% for ip in blocked_v4 %}
|
||||
{{ ip }}{{ ',' if not loop.last else '' }}
|
||||
{% endfor %}
|
||||
}
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
{% if blocked_v6 | length > 0 %}
|
||||
set blocked_v6 {
|
||||
type ipv6_addr
|
||||
flags interval
|
||||
elements = {
|
||||
{% for ip in blocked_v6 %}
|
||||
{{ ip }}{{ ',' if not loop.last else '' }}
|
||||
{% endfor %}
|
||||
}
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
{% if trusted_v4 | length > 0 %}
|
||||
set trusted_v4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
elements = {
|
||||
{% for ip in trusted_v4 %}
|
||||
{{ ip }}{{ ',' if not loop.last else '' }}
|
||||
{% endfor %}
|
||||
}
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
{% if trusted_v6 | length > 0 %}
|
||||
set trusted_v6 {
|
||||
type ipv6_addr
|
||||
flags interval
|
||||
elements = {
|
||||
{% for ip in trusted_v6 %}
|
||||
{{ ip }}{{ ',' if not loop.last else '' }}
|
||||
{% endfor %}
|
||||
}
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
chain input {
|
||||
type filter hook input priority 0;
|
||||
policy {{ security_firewall_default_policy | default('drop') }};
|
||||
type filter hook input priority filter; policy {{ default_policy }};
|
||||
|
||||
# Conntrack: allow established, drop invalid
|
||||
ct state established,related accept
|
||||
iifname lo accept
|
||||
ct state invalid drop
|
||||
|
||||
# allow ICMP
|
||||
ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded } accept
|
||||
ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
|
||||
# Blocked IPs — earliest possible drop
|
||||
{% if blocked_v4 | length > 0 %}
|
||||
ip saddr @blocked_v4 counter drop
|
||||
{% endif %}
|
||||
{% if blocked_v6 | length > 0 %}
|
||||
ip6 saddr @blocked_v6 counter drop
|
||||
{% endif %}
|
||||
|
||||
{% for p in security_firewall_allowed_ports %}
|
||||
{% set parts = p.split('/') %}
|
||||
{% set port = parts[0] %}
|
||||
{% set proto = parts[1] if parts|length > 1 else 'tcp' %}
|
||||
{{ proto }} dport {{ port }} accept
|
||||
# Trusted interfaces (loopback, wireguard, etc.)
|
||||
{% for iface in trusted_interfaces %}
|
||||
iifname "{{ iface }}" accept
|
||||
{% endfor %}
|
||||
|
||||
reject with icmpx type port-unreachable
|
||||
# Trusted IPs — bypass all further filtering
|
||||
{% if trusted_v4 | length > 0 %}
|
||||
ip saddr @trusted_v4 accept
|
||||
{% endif %}
|
||||
{% if trusted_v6 | length > 0 %}
|
||||
ip6 saddr @trusted_v6 accept
|
||||
{% endif %}
|
||||
|
||||
# ICMP / ICMPv6 — essential types{% if rate_limit_enabled %} (rate-limited){% endif %}
|
||||
|
||||
{% if rate_limit_enabled %}
|
||||
ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded } limit rate {{ icmp_rate }} accept
|
||||
ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } limit rate {{ icmp_rate }} accept
|
||||
{% else %}
|
||||
ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded } accept
|
||||
ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } accept
|
||||
{% endif %}
|
||||
|
||||
# Allowed ports
|
||||
{% if allowed_ports | length > 0 %}
|
||||
{% for p in allowed_ports %}
|
||||
{% set parts = p.split('/') %}
|
||||
{% set port = parts[0] %}
|
||||
{% set proto = parts[1] if parts | length > 1 else 'tcp' %}
|
||||
{% if ':' in port %}
|
||||
{% set range_parts = port.split(':') %}
|
||||
{{ proto }} dport {{ range_parts[0] }}-{{ range_parts[1] }} accept
|
||||
{% else %}
|
||||
{{ proto }} dport {{ port }} accept
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if allowed_port_ranges | length > 0 %}
|
||||
# Allowed port ranges
|
||||
{% for rule in allowed_port_ranges %}
|
||||
{% set proto = rule.proto | default('tcp') %}
|
||||
{% set comment = ' comment "' + rule.comment + '"' if rule.comment is defined else '' %}
|
||||
{% if rule.source is defined %}
|
||||
ip saddr {{ rule.source }} {{ proto }} dport {{ rule.start }}-{{ rule.end }} accept{{ comment }}
|
||||
{% else %}
|
||||
{{ proto }} dport {{ rule.start }}-{{ rule.end }} accept{{ comment }}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if rate_limit_enabled %}
|
||||
# SYN flood protection: drop new connections that exceed the rate limit.
|
||||
# Placed after port-allow rules so only accepted ports are reachable,
|
||||
# and excess SYN packets to those ports are dropped.
|
||||
tcp flags & (fin | syn | rst | ack) == syn ct state new limit rate over {{ ct_rate }} burst {{ ct_rate_burst }} packets counter drop
|
||||
{% endif %}
|
||||
|
||||
{% if custom_input_rules | length > 0 %}
|
||||
# Custom input rules
|
||||
{% for rule in custom_input_rules %}
|
||||
{{ rule }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if log_dropped %}
|
||||
# Log before final reject/drop
|
||||
log prefix "{{ log_prefix }}" flags all counter
|
||||
{% endif %}
|
||||
{% if default_policy == 'drop' %}
|
||||
# Polite rejects before the implicit policy drop
|
||||
tcp dport 1-65535 counter reject with tcp reset
|
||||
counter reject with icmpx type port-unreachable
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0;
|
||||
policy accept;
|
||||
type filter hook forward priority filter; policy {{ forward_policy }};
|
||||
|
||||
# Conntrack
|
||||
ct state established,related accept
|
||||
ct state invalid drop
|
||||
|
||||
{% if blocked_v4 | length > 0 %}
|
||||
ip saddr @blocked_v4 counter drop
|
||||
{% endif %}
|
||||
{% if blocked_v6 | length > 0 %}
|
||||
ip6 saddr @blocked_v6 counter drop
|
||||
{% endif %}
|
||||
|
||||
{% if dnat_rules | length > 0 %}
|
||||
# Accept forwarded traffic for DNAT destinations (needed if forward policy != accept)
|
||||
{% for rule in dnat_rules %}
|
||||
{% set proto = rule.proto | default('tcp') %}
|
||||
{% set comment = ' comment "DNAT fwd: ' + rule.comment + '"' if rule.comment is defined else '' %}
|
||||
{% set dest_parts = rule.dest.split(':') %}
|
||||
{% set dest_ip = dest_parts[0] %}
|
||||
{% set dest_port = dest_parts[1] if dest_parts | length > 1 else rule.port | string %}
|
||||
ip daddr {{ dest_ip }} {{ proto }} dport {{ dest_port }} accept{{ comment }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if custom_forward_rules | length > 0 %}
|
||||
# Custom forward rules
|
||||
{% for rule in custom_forward_rules %}
|
||||
{{ rule }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0;
|
||||
policy accept;
|
||||
type filter hook output priority filter; policy {{ output_policy }};
|
||||
|
||||
ct state established,related accept
|
||||
|
||||
{% if custom_output_rules | length > 0 %}
|
||||
# Custom output rules
|
||||
{% for rule in custom_output_rules %}
|
||||
{{ rule }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
}
|
||||
}
|
||||
|
||||
{% if security_nftables_custom_config is defined and security_nftables_custom_config | trim %}
|
||||
{{ security_nftables_custom_config | trim }}
|
||||
{% if has_nat %}
|
||||
table ip ansible_nat {
|
||||
|
||||
{% if dnat_rules | length > 0 %}
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
|
||||
{% for rule in dnat_rules %}
|
||||
{% set proto = rule.proto | default('tcp') %}
|
||||
{% set comment = ' comment "' + rule.comment + '"' if rule.comment is defined else '' %}
|
||||
{% set dnat_match = [] %}
|
||||
{% if rule.iif is defined %}
|
||||
{% set _ = dnat_match.append('iifname "' + rule.iif + '"') %}
|
||||
{% endif %}
|
||||
{% if rule.source is defined %}
|
||||
{% set _ = dnat_match.append('ip saddr ' + rule.source) %}
|
||||
{% endif %}
|
||||
{% set _ = dnat_match.append(proto + ' dport ' + rule.port | string) %}
|
||||
{{ dnat_match | join(' ') }} dnat to {{ rule.dest }}{{ comment }}
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
{% if snat_rules | length > 0 or masquerade_interfaces | length > 0 %}
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
{% for rule in snat_rules %}
|
||||
{% set comment = ' comment "' + rule.comment + '"' if rule.comment is defined else '' %}
|
||||
{% set proto = rule.proto | default('') %}
|
||||
{% set match_parts = [] %}
|
||||
{% if rule.iif is defined %}
|
||||
{% set _ = match_parts.append('iifname "' + rule.iif + '"') %}
|
||||
{% endif %}
|
||||
{% if rule.oif is defined %}
|
||||
{% set _ = match_parts.append('oifname "' + rule.oif + '"') %}
|
||||
{% endif %}
|
||||
{% if rule.source is defined %}
|
||||
{% set _ = match_parts.append('ip saddr ' + rule.source) %}
|
||||
{% endif %}
|
||||
{% if rule.dest is defined %}
|
||||
{% set _ = match_parts.append('ip daddr ' + rule.dest) %}
|
||||
{% endif %}
|
||||
{% if proto %}
|
||||
{% if rule.dport is defined %}
|
||||
{% set _ = match_parts.append(proto + ' dport ' + rule.dport | string) %}
|
||||
{% endif %}
|
||||
{% if rule.sport is defined %}
|
||||
{% set _ = match_parts.append(proto + ' sport ' + rule.sport | string) %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if rule.masquerade | default(false) %}
|
||||
{{ match_parts | join(' ') }} masquerade{{ comment }}
|
||||
{% else %}
|
||||
{{ match_parts | join(' ') }} snat to {{ rule.to }}{{ comment }}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
{% for iface in masquerade_interfaces %}
|
||||
oifname "{{ iface }}" masquerade
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
}
|
||||
{% endif %}
|
||||
|
||||
{% if custom_raw | trim | length > 0 %}
|
||||
{{ custom_raw | trim }}
|
||||
{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user