puppet-modules/modules/iptables/manifests/ng/header.pp at db6aaa4e8b1dce6db8abeef7783be9b106ca89c4 · dhtech/puppet-modules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Copyright 2018 dhtech
#
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file
#
# Initial iptables rules that always applies

class iptables::ng::header {

  iptables::ng::advanced_rule { 'accept related established rules':
    type  => 'both',
    order => 1,
    rule  => [
      '-A INPUT -m state --state RELATED,ESTABLISHED',
      '-m comment --comment "accept related established rules"',
      '-j ACCEPT',
    ].join(' '),
  }

  iptables::ng::advanced_rule { 'accept all to lo interface':
    type  => 'both',
    order => 10,
    rule  => [
      '-A INPUT -i lo',
      '-m comment --comment "accept all to lo interface"',
      '-j ACCEPT',
    ].join(' '),
  }


  # IPv4 ICMP
  iptables::ng::advanced_rule { 'v4 accept icmp, heavy rate limited':
    type  => 'ipv4',
    order => 20,
    rule  => [
      '-A INPUT -p icmp',
      '-m limit --limit 5/sec --limit-burst 20',
      '-m comment --comment "accept icmp, heavy rate limited"',
      '-j ACCEPT',
    ].join(' '),
  }

  iptables::ng::advanced_rule { 'v4 reject with icmp udp echo, heavy rate limited':
    type  => 'ipv4',
    order => 21,
    rule  => [
      '-A INPUT -p udp',
      '-m multiport --dports 33434:33523',
      '-m limit --limit 5/sec --limit-burst 20',
      '-m comment --comment "reject with icmp udp echo, heavy rate limited"',
      '-j REJECT --reject-with icmp-port-unreachable',
    ].join(' '),
  }

  iptables::ng::advanced_rule { 'v4 drop remaining icmp':
    type  => 'ipv4',
    order => 29,
    rule  => [
      '-A INPUT -p icmp',
      '-m comment --comment "drop remaining icmp"',
      '-j DROP',
    ].join(' '),
  }


  # IPv6 ICMP
  iptables::ng::advanced_rule { 'v6 accept icmp, heavy rate limited':
    type  => 'ipv6',
    order => 20,
    rule  => [
      '-A INPUT -p ipv6-icmp',
      '-m limit --limit 5/sec --limit-burst 20',
      '-m comment --comment "accept icmp, heavy rate limited"',
      '-j ACCEPT',
    ].join(' '),
  }

  iptables::ng::advanced_rule { 'v6 reject with icmp udp echo, heavy rate limited':
    type  => 'ipv6',
    order => 21,
    rule  => [
      '-A INPUT -p udp',
      '-m multiport --dports 33434:33523',
      '-m limit --limit 5/sec --limit-burst 20',
      '-m comment --comment "reject with icmp udp echo, heavy rate limited"',
      '-j REJECT --reject-with icmp6-port-unreachable',
    ].join(' '),
  }

  iptables::ng::advanced_rule { 'v6 drop remaining icmp':
    type  => 'ipv6',
    order => 29,
    rule  => [
      '-A INPUT -p ipv6-icmp',
      '-m comment --comment "drop remaining icmp"',
      '-j DROP',
    ].join(' '),
  }

}