add firewall rulesets for waldo.asininetech.net.

2019-08-21 22:12:42 -04:00 · 2019-08-21 22:12:42 -04:00 · 985895c082
commit 985895c082
parent df3044c9f3
2 changed files with 116 additions and 0 deletions
--- a/ubuntu/roles/firewall-ruleset-deploy/files/waldo.asininetech.net.rules.v4
+++ b/ubuntu/roles/firewall-ruleset-deploy/files/waldo.asininetech.net.rules.v4
@ -0,0 +1,54 @@
+# Generated by iptables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+-A INPUT -s 173.244.135.0/24 -m comment --comment "infegy data collection" -j DROP
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
+-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5665 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 4949 -j ACCEPT
+-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -o lo -j ACCEPT
+-A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
+-A OUTPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
+-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 5665 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by iptables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*mangle
+:PREROUTING ACCEPT [218487873:77836206409]
+:INPUT ACCEPT [218472743:77835851657]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [198640222:231265817270]
+:POSTROUTING ACCEPT [198514192:231251706844]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by iptables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*nat
+:PREROUTING ACCEPT [395831:23115645]
+:INPUT ACCEPT [342246:20080838]
+:OUTPUT ACCEPT [2104459:144197031]
+:POSTROUTING ACCEPT [2056326:133263204]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by iptables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*raw
+:PREROUTING ACCEPT [218487873:77836206409]
+:OUTPUT ACCEPT [198640222:231265817270]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by iptables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*security
+:INPUT ACCEPT [218343605:77829541325]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [198514192:231251706844]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
--- a/ubuntu/roles/firewall-ruleset-deploy/files/waldo.asininetech.net.rules.v6
+++ b/ubuntu/roles/firewall-ruleset-deploy/files/waldo.asininetech.net.rules.v6
@ -0,0 +1,62 @@
+# Generated by ip6tables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+:icmp_in - [0:0]
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
+-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 5665 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 4949 -j ACCEPT
+-A INPUT -p ipv6-icmp -j icmp_in
+-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -o lo -j ACCEPT
+-A OUTPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
+-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 587 -j ACCEPT
+-A OUTPUT -p ipv6-icmp -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 5665 -j ACCEPT
+-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 3 -j ACCEPT
+-A icmp_in -p ipv6-icmp -m icmp6 --icmpv6-type 4 -j ACCEPT
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by ip6tables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*mangle
+:PREROUTING ACCEPT [70193758:23194099590]
+:INPUT ACCEPT [70193724:23194096614]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [85031518:98010620009]
+:POSTROUTING ACCEPT [85022058:98009850269]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by ip6tables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*raw
+:PREROUTING ACCEPT [70193758:23194099590]
+:OUTPUT ACCEPT [85031518:98010620009]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by ip6tables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*security
+:INPUT ACCEPT [70184454:23193336835]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [85022058:98009850269]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019
+# Generated by ip6tables-save v1.6.1 on Wed Jun  5 07:00:25 2019
+*nat
+:PREROUTING ACCEPT [93205:8443266]
+:INPUT ACCEPT [92957:8404954]
+:OUTPUT ACCEPT [340319:31645894]
+:POSTROUTING ACCEPT [336994:31244254]
+COMMIT
+# Completed on Wed Jun  5 07:00:25 2019