zlopez/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Merge branch 'nftables' into upstream

Browse source 
* nftables: (2 commits)
  Cleanup nft merge. Chg osbuildapi and nft_custom_rules to use nft_table_filter.
  ...

Signed-off-by: James Antill <james@and.org>
This commit is contained in:
James Antill 2026-06-01 17:33:24 -04:00
commit 5c6868260b
70 changed files with 759 additions and 997 deletions
Download patch file Download diff file Expand all files Collapse all files

6
inventory/group_vars/all
View file

@ -154,6 +154,12 @@ nftables: True
nft_custom6_rules: []
nft_custom_rules: []
nft_nat_rules: []
# Table names for nft
# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets.
nft_table_filter: "ip cle_infra_filter"
nft_table_nat: "ip cle_infra_nat"
nft_table_raw: "ip cle_infra_raw"
nft_table6_filter: "ip6 cle_infra_filter"
# usually we do not want to enable nested virt, only on some virthosts
nested: false
network_allow_restart: yes

2
inventory/group_vars/autosign
View file

@ -10,7 +10,7 @@ ansible_ifcfg_allowlist:
# Make connections from signing bridges stateless, they break sigul connections
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
host_group: autosign
ipa_client_shell_groups:
- sysadmin-releng

2
inventory/group_vars/autosign_hardware
View file

@ -2,5 +2,5 @@
# Make connections from signing bridges stateless, they break sigul connections
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
host_group: autosign

4
inventory/group_vars/bastion
View file

@ -8,8 +8,8 @@
#
custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT']
nft_block_rules:
- 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
- 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
#
# This host is externally reachable
#

4
inventory/group_vars/bastion_stg
View file

@ -19,8 +19,8 @@ batcave_ipa_client_shell_groups: []
#
custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT']
nft_block_rules:
- 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
- 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept'
ipa_client_shell_groups: "{{ (bastion_ipa_client_shell_groups + batcave_ipa_client_shell_groups) | sort | unique }}"
#
# allow a bunch of sysadmin groups here so they can access internal stuff

4
inventory/group_vars/batcave
View file

@ -4,8 +4,8 @@ ansible_base: /srv/web/infra
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
#
# This host is externally reachable
#

2
inventory/group_vars/bodhi_backend
View file

@ -7,7 +7,7 @@ bodhi_message_routing_keys:
# Make connections from signing bridges stateless, they break sigul connections
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept']
host_group: bodhi2
ipa_client_shell_groups:
- sysadmin-bodhi

2
inventory/group_vars/bodhi_backend_stg
View file

@ -9,7 +9,7 @@ bodhi_message_routing_keys:
# https://bugzilla.redhat.com/show_bug.cgi?id=1283364
# this is sign-bridge01.rdu3 ip 10.16.169.120
custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept']
host_group: bodhi2
ipa_client_shell_groups:
- sysadmin-bodhi

4
inventory/group_vars/certgetter
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
lvm_size: 20000
mem_size: 2048
num_cpus: 2

4
inventory/group_vars/certgetter_stg
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
lvm_size: 20000
mem_size: 2048
num_cpus: 2

14
inventory/group_vars/copr_hypervisor
View file

@ -47,13 +47,13 @@ nbde_client_bindings:
libvirt_host: "{{ inventory_hostname }}"
nft_custom_rules:
- add rule ip filter INPUT iifname virbr0 udp dport bootps accept
- add rule ip filter INPUT iifname virbr0 udp dport 53 accept
- add rule ip filter INPUT iifname virbr0 tcp dport ssh accept
- add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept
- add rule ip filter FORWARD iifname "virbr0" ct state new counter accept
- add rule ip filter FORWARD ct state established,related counter accept
- add rule ip filter FORWARD ip protocol icmp counter accept
- add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept
- add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept
- add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept
- add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept
- add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept
- add rule {{nft_table_filter}} FORWARD ct state established,related counter accept
- add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept
zabbix_macros:
CPU.UTIL.CRIT: 100

8
inventory/group_vars/copr_keygen_aws
View file

@ -9,10 +9,10 @@ custom_rules:
- '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT'
- '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT'
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept'
- 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept'
- 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept'
- 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept'
freezes: false
tcp_ports: [22,
# node_exporter/prometheus

8
inventory/group_vars/copr_keygen_dev_aws
View file

@ -9,10 +9,10 @@ custom_rules:
- '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT'
- '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT'
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept'
- 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept'
- 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept'
- 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept'
freezes: false
tcp_ports: [22,
# node_exporter/prometheus

2
inventory/group_vars/download
View file

@ -115,7 +115,7 @@ ipa_host_group_desc: Download servers
nagios_Check_Services:
swap: false
nft_block_rules:
- 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject'
primary_auth_source: ipa
zabbix_macros:
'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status

2
inventory/group_vars/ipa
View file

@ -1,7 +1,7 @@
---
# Define resources for this group of hosts here.
custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept']
host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG']
ipa_client_shell_groups:
- sysadmin-accounts

4
inventory/group_vars/ipatuura_stg
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
ipa_host_group: ipatuura
ipa_host_group_desc: IPA-tuura SCIM application
ipa_client_shell_groups:

4
inventory/group_vars/ipsilon
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
ipa_host_group: ipsilon
ipa_host_group_desc: Ipsilon SSO application
ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org"

4
inventory/group_vars/ipsilon_rdu3
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
ipa_host_group: ipsilon
ipa_host_group_desc: Ipsilon SSO application
ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org"

4
inventory/group_vars/ipsilon_stg
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
ipa_host_group: ipsilon
ipa_host_group_desc: Ipsilon SSO application
ipa_client_shell_groups:

4
inventory/group_vars/ipsilon_stg_rdu3
View file

@ -3,8 +3,8 @@
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
ipa_host_group: ipsilon
ipa_host_group_desc: Ipsilon SSO application
ipa_client_shell_groups:

2
inventory/group_vars/kernel_qa
View file

@ -1,6 +1,6 @@
---
custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept']
freezes: false
ipa_client_shell_groups:
- sysadmin-kernel

4
inventory/group_vars/koji
View file

@ -5,8 +5,8 @@ custom_rules: [
'-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT']
# Needed for keepalived
nft_custom_rules:
- 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept'
- 'add rule ip filter INPUT ip protocol vrrp counter accept'
- 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept'
docker_registry: "candidate-registry.fedoraproject.org"
ipa_client_shell_groups:
- sysadmin-releng

4
inventory/group_vars/kojipkgs
View file

@ -6,8 +6,8 @@ custom_rules: [
'-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
# Need for rsync from log01 for logs.
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
ipa_client_shell_groups:
- sysadmin-noc
- sysadmin-releng

6
inventory/group_vars/openqa_tap_workers
View file

@ -2,9 +2,9 @@
# uses interface definition from host vars
custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter FORWARD iifname "br0" counter accept'
- 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
- 'add rule ip filter INPUT iifname "br0" counter accept'
- 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept'
- 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept'
- 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept'
# for iptables rules...maybe other stuff in future? both staging
# and prod workers are in this group
host_group: openqa-tap-workers

6
inventory/group_vars/os_proxies
View file

@ -6,10 +6,10 @@ custom_rules: [
'-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT']
nft_custom_rules:
# Needed for keepalived
- 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept'
- 'add rule ip filter INPUT ip protocol vrrp counter accept'
- 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept'
# machinectl api
- 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept'
datacenter: cloud
host_group: cloud
lvm_size: 20000

58
inventory/group_vars/pagure
View file

@ -8,35 +8,35 @@ custom_rules: [
'-A INPUT -s 47.76.99.127/32 -j REJECT'
]
nft_block_rules:
- 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject'
- 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject'
- 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject'
- 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject'
- 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject'
- 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject'
- 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject'
- 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject'
- 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject'
- 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject'
- 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject'
- 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject'
- 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject'
# For the MOTD
db_backup_dir: ['/backups']
dbs_to_backup: ['pagure']

2
inventory/group_vars/people
View file

@ -6,7 +6,7 @@ clamscan_paths:
# For the MOTD
# Neeed for rsync from log01 for logs.
custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT']
nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept']
git_basepath: /
git_daemon_user: nobody
git_port: 9418

162
inventory/group_vars/proxies
View file

@ -34,91 +34,91 @@ custom_rules: [
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT']
nft_block_rules:
- 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject'
- 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject'
- 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject'
- 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject'
- 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject'
- 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject'
- 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject'
- 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject'
- 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject'
- 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject'
- 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject'
- 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject'
- 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject'
- 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject'
- 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject'
- 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject'
- 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject'
- 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject'
- 'add rule ip filter INPUT ip saddr 208.78.212.5/32 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 208.78.212.5/32 counter reject'
nft_custom_rules:
# Need for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept'
# allow varnish from localhost
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
# also allow varnish from internal for purge requests
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept'
external: true
ipa_client_shell_groups:
- fi-apprentice

62
inventory/group_vars/proxies_stg
View file

@ -11,44 +11,44 @@ custom_rules: [
'-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT',
'-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT']
nft_block_rules:
- 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject'
- 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject'
nft_custom_rules:
# Need for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
# allow varnish from localhost
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
# also allow varnish from internal for purge requests
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
# Need for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept'
# allow varnish from localhost
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept'
# also allow varnish from internal for purge requests
- 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept'
external: true
ipa_client_shell_groups:
- fi-apprentice

16
inventory/group_vars/rabbitmq
View file

@ -9,16 +9,16 @@ custom_rules: [
]
nft_custom_rules:
# Neeed for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
# Inter-node traffic
- 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
# In RDU3
- 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept'
ipa_host_group: rabbitmq
ipa_host_group_desc: RabbitMQ service
ipa_shell_groups:

16
inventory/group_vars/rabbitmq_stg
View file

@ -9,16 +9,16 @@ custom_rules: [
]
nft_custom_rules:
# Neeed for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
# Inter-node traffic
- 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
# In RDU3
- 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept'
ipa_host_group: rabbitmq
ipa_host_group_desc: RabbitMQ service
ipa_shell_groups:

4
inventory/group_vars/retrace
View file

@ -3,8 +3,8 @@ custom_rules:
- '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT'
- '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT'
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept'
- 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept'
env: production
freezes: false
ipa_client_shell_groups:

10
inventory/group_vars/value
View file

@ -10,13 +10,13 @@ custom_rules: [
'-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT']
nft_custom_rules:
# Needed for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
# Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept'
# batcave01 also needs access to announce commits.
- 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
deployment_type: prod
ipa_client_shell_groups:
- fi-apprentice

12
inventory/group_vars/value_stg
View file

@ -10,14 +10,14 @@ custom_rules: [
'-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT']
nft_custom_rules:
# Neeed for rsync from log01 for logs.
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
# Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
- 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept'
# batcave01 also needs access to announce commits.
- 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept'
deployment_type: stg
ipa_client_shell_groups:
- fi-apprentice

18
inventory/host_vars/db-fas01.rdu3.fedoraproject.org
View file

@ -4,17 +4,17 @@
#
nft_custom_rules:
# Openshift nodes (egress policy will block connection from non-authorized projects)
- 'add rule ip filter INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept'
# noc01 needs to connect to check the db
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
# Ipsilon VMs
- 'add rule ip filter INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept'
# This is a generic list, monitored by collectd
databases:
- fas2

2
inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org
View file

@ -5,7 +5,7 @@
#
# TODO: lock it down more
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept'
# This is a generic list, monitored by collectd
databases:
- fas2

8
inventory/host_vars/db-koji01.rdu3.fedoraproject.org
View file

@ -3,10 +3,10 @@
# Only allow postgresql access from the frontend node.
#
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept'
# This is a generic list, monitored by collectd
databases:
- koji

2
inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org
View file

@ -2,7 +2,7 @@
#
# Only allow postgresql access from the frontend node.
#
nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept']
# This is a generic list, monitored by collectd
databases:
- koji

2
inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org
View file

@ -2,7 +2,7 @@
# This is a generic list, monitored by collectd
custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.172.21 --dport 5432 -j ACCEPT']
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept'
databases:
- koji
datacenter: rdu3

2
inventory/host_vars/db01.rdu3.fedoraproject.org
View file

@ -2,7 +2,7 @@
#
# We should narrow this down at some point
#
nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept']
# This is a generic list, monitored by collectd
databases:
- anitya

2
inventory/host_vars/db01.stg.rdu3.fedoraproject.org
View file

@ -2,7 +2,7 @@
#
# We should narrow this down at some point
#
nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept']
nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept']
# This is a generic list, monitored by collectd
databases:
- askfedora

10
inventory/host_vars/noc01.rdu3.fedoraproject.org
View file

@ -6,13 +6,13 @@ custom_rules: [
'-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'
]
nft_custom_rules:
- 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept'
# needed to allow rsync from log01
- 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'
# needed to allow 8080 (firmware-proxy from iDRAC mgmt vlans
- 'add rule ip filter INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept'
- 'add rule ip filter INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept'
- 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept'
datacenter: rdu3
eth0_ipv4_gw: 10.16.163.254
eth0_ipv4_ip: 10.16.163.10

14
roles/base/templates/nftables/_nft_accept_beg Normal file
View file

@ -0,0 +1,14 @@
# {{ ansible_managed }}
# _nft_accept_beg
# Setup an ip filter table with default accept policy, and the std. allow rules.
# Set small Table Names.
# We need the big global ones so we can use them in *_rules but, that would be
# a lot in these files.
{% set _tn = nft_table_filter %}
{% set _tnat = nft_table_nat %}
add table {{_tn}}
add chain {{_tn}} INPUT { type filter hook input priority 0; policy accept; }
add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; }
add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; }

7
roles/base/templates/nftables/_nft_accept_end Normal file
View file

@ -0,0 +1,7 @@
# _nft_accept_end
# Default accept policy, standard end rules
# This kind of makes it default drop, but the spelling is weird.
# otherwise kick everything out
add rule {{_tn}} INPUT counter reject with icmp type host-prohibited
add rule {{_tn}} FORWARD counter reject with icmp type host-prohibited

6
roles/base/templates/nftables/_nft_accept_http Normal file
View file

@ -0,0 +1,6 @@
# _nft_accept_http
# Accept HTTP(s)
add rule {{_tn}} INPUT ct state new tcp dport 80 counter accept
add rule {{_tn}} INPUT ct state new tcp dport 443 counter accept

15
roles/base/templates/nftables/_nft_accept_monitoring Normal file
View file

@ -0,0 +1,15 @@
# _nft_accept_monitoring
# Default accept policy, let things be monitored
# for nrpe - allow it from nocs
#add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
#add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule {{_tn}} INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule {{_tn}} INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# zabbix01
add rule {{_tn}} INPUT tcp dport 10051 counter accept
add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept

16
roles/base/templates/nftables/_nft_accept_ports Normal file
View file

@ -0,0 +1,16 @@
# _nft_accept_ports
# Default accept policy, accept host defined tcp/udp ports
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule {{_tn}} INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule {{_tn}} INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}

17
roles/base/templates/nftables/_nft_accept_proxy_ports Normal file
View file

@ -0,0 +1,17 @@
# _nft_accept_proxy_ports
# Default accept policy, deal with proxy ports (if defined)
# if there are any proxy-only tcp_ports - allow them
{% if proxy_tcp_ports is defined %}
{% for port in proxy_tcp_ports %}
{% for proxy in (groups['proxies'] + groups['proxies_internal']) %}
{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %}
add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% else %}
add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% endif %}
{% endfor %}
# nagios
add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}

6
roles/base/templates/nftables/_nft_accept_ssh Normal file
View file

@ -0,0 +1,6 @@
# _nft_accept_ssh
# Accept ssh
# allow ssh - always
add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept

13
roles/base/templates/nftables/_nft_accept_staging_friends Normal file
View file

@ -0,0 +1,13 @@
# _nft_accept_staging_friends
{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %}
#
# In the rdu3 datacenter, both production and staging hosts are in different
# vlans, and different subnets. However, just as a precaution, we want prod machines to
# reject connections from any staging host just in case there's some globally enabled port.
# There are however a few hosts in production we have marked 'staging-friendly'
# that we do allow staging to talk to for mostly read-only data they need.
#
add rule {{_tn}} INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited
add rule {{_tn}} INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited
{% endif %}

12
roles/base/templates/nftables/_nft_accept_std Normal file
View file

@ -0,0 +1,12 @@
# _nft_accept_std
# Standard accept lines, SSH is _not_ here.
# allow ping and traceroute
add rule {{_tn}} INPUT ip protocol icmp counter accept
# localhost is fine
add rule {{_tn}} INPUT iifname "lo" counter accept
# Established connections allowed
add rule {{_tn}} INPUT ct state related,established counter accept
add rule {{_tn}} OUTPUT ct state related,established counter accept

30
roles/base/templates/nftables/_nft_accept_vpn Normal file
View file

@ -0,0 +1,30 @@
# _nft_accept_vpn
# Default accept policy, vpn stuff.
# NOTE: That the end of this file rejects all other VPN traffic.
{% if vpn %}
#
# We want to have all vpn hosts reject most things from the 'less secure' vpn network
#
{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %}
# Allow all vpn hosts to talk to the log server for rsyslog
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept
{% endif %}
{% if inventory_hostname in groups['ipa'] %}
# Allow all vpn hosts to talk to the ipa servers for auth
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept
{% endif %}
# Reject all further connections from less secure vpn
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
{% endif %}

9
roles/base/templates/nftables/_nft_block_rules Normal file
View file

@ -0,0 +1,9 @@
# _nft_block_rules
# Default accept policy, standard end rules
{% if nft_block_rules is defined %}
# if there are block rules - put them in as-is
{% for rule in nft_block_rules %}
{{ rule }}
{% endfor %}
{% endif %}

3
roles/base/templates/nftables/_nft_blocked_ips
View file

@ -4,7 +4,6 @@
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
add rule ip filter INPUT ip saddr {{ ip }} counter drop
add rule {{_tn}} INPUT ip saddr {{ ip }} counter drop
{% endfor %}
{% endif %}

9
roles/base/templates/nftables/_nft_custom_rules Normal file
View file

@ -0,0 +1,9 @@
# _nft_custom_rules
# Probably only use for: Default accept policy
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}

17
roles/base/templates/nftables/_nft_drop_beg Normal file
View file

@ -0,0 +1,17 @@
# {{ ansible_managed }}
# _nft_drop_beg
# Setup an ip filter table with default drop policy.
#
# Note that there's no _nft_drop_end because _nft_accept_end drops everything
# and we don't need that.
# Set small Table Names.
# We need the big global ones so we can use them in *_rules but, that would be
# a lot in these files.
{% set _tn = nft_table_filter %}
{% set _tnat = nft_table_nat %}
add table {{_tn}}
add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; }
add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; }
add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy drop; }

12
roles/base/templates/nftables/_nft_drop_std Normal file
View file

@ -0,0 +1,12 @@
# _nft_drop_std
# Std. allow rules for the drop policy
{% include '_nft_accept_std' %}
# MORE loopback allowed
add rule {{_tn}} OUTPUT oifname "lo" counter accept
add rule {{_tn}} INPUT iifname "virbr0" counter accept
add rule {{_tn}} OUTPUT oifname "virbr0" counter accept
add rule {{_tn}} INPUT ip daddr 127.0.0.0/8 counter accept
add rule {{_tn}} OUTPUT ip daddr 127.0.0.0/8 counter accept

15
roles/base/templates/nftables/_nft_nat Normal file
View file

@ -0,0 +1,15 @@
# _nft_nat
# Setup forwarding via. "ip nat" table, if we have nat rules.
{% if nft_nat_rules is defined %}
add table {{_tnat}}
add chain {{_tnat}} PREROUTING { type nat hook prerouting priority {{_nft_prio_preroute}}; policy accept; }
add chain {{_tnat}} INPUT { type nat hook input priority {{_nft_prio_input}}; policy accept; }
add chain {{_tnat}} OUTPUT { type nat hook output priority {{_nft_prio_output}}; policy accept; }
add chain {{_tnat}} POSTROUTING { type nat hook postrouting priority {{_nft_prio_postroute}}; policy accept; }
{% for rule in nft_nat_rules %}
{{ rule }}
{% endfor %}
{% endif %}

136
roles/base/templates/nftables/nftables
View file

@ -1,128 +1,32 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# allow ping and traceroute
add rule ip filter INPUT ip protocol icmp counter accept
{% include '_nft_accept_beg' %}
# localhost is fine
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_std' %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
{% include '_nft_accept_ssh' %}
# allow ssh - always
add rule ip filter INPUT ct state new tcp dport 22 counter accept
{% include '_nft_accept_monitoring' %}
# rdu3
# for nrpe - allow it from nocs
#add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
#add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# zabbix01
add rule ip filter INPUT tcp dport 10051 counter accept
add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept
{% include '_nft_accept_vpn' %}
{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %}
#
# In the rdu3 datacenter, both production and staging hosts are in different
# vlans, and different subnets. However, just as a precaution, we want prod machines to
# reject connections from any staging host just in case there's some globally enabled port.
# There are however a few hosts in production we have marked 'staging-friendly'
# that we do allow staging to talk to for mostly read-only data they need.
#
add rule ip filter INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited
add rule ip filter INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited
{% endif %}
{% include '_nft_accept_staging_friends' %}
{% if vpn %}
#
# We want to have all vpn hosts reject most things from the 'less secure' vpn network
#
{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %}
# Allow all vpn hosts to talk to the log server for rsyslog
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept
{% endif %}
{% if inventory_hostname in groups['ipa'] %}
# Allow all vpn hosts to talk to the ipa servers for auth
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept
{% include '_nft_block_rules' %}
add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept
{% endif %}
# Reject all further connections from less secure vpn
add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
{% endif %}
{% include '_nft_accept_ports' %}
{% include '_nft_accept_proxy_ports' %}
{% include '_nft_custom_rules' %}
{% include '_nft_accept_end' %}
{% if nft_block_rules is defined %}
# if there are block rules - put them in as-is
{% for rule in nft_block_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% set _nft_prio_preroute = "-100" %}
{% set _nft_prio_input = "100" %}
{% set _nft_prio_output = "-100" %}
{% set _nft_prio_postroute = "100" %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if there are any proxy-only tcp_ports - allow them
{% if proxy_tcp_ports is defined %}
{% for port in proxy_tcp_ports %}
{% for proxy in (groups['proxies'] + groups['proxies_internal']) %}
{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %}
add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% else %}
add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% endif %}
{% endfor %}
# nagios
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
{% if nft_nat_rules is defined %}
add table ip nat
add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; }
add chain ip nat INPUT { type nat hook input priority 100; policy accept; }
add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; }
add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; }
{% for rule in nft_nat_rules %}
{{ rule }}
{% endfor %}
{% endif %}
{% include '_nft_nat' %}

39
roles/base/templates/nftables/nftables-ipv6
View file

@ -1,48 +1,51 @@
# {{ ansible_managed }}
add table ip6 filter
add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; }
# Set small Table Names.
# We need the big global ones so we can use them in *_rules but, that would be
# a lot in these files.
{% set _tn6 = nft_table6_filter %}
add table {{_tn6}}
add chain {{_tn6}} INPUT { type filter hook input priority 0; policy accept; }
add chain {{_tn6}} FORWARD { type filter hook forward priority 0; policy accept; }
add chain {{_tn6}} OUTPUT { type filter hook output priority 0; policy accept; }
# loopback allowed
add rule ip6 filter INPUT iifname "lo" counter accept
add rule {{_tn6}} INPUT iifname "lo" counter accept
# Accept ping and traceroute (needs icmp)
add rule ip6 filter INPUT meta l4proto ipv6-icmp counter accept
add rule {{_tn6}} INPUT meta l4proto ipv6-icmp counter accept
# Established connections allowed
add rule ip6 filter INPUT ct state related,established counter accept
add rule {{_tn6}} INPUT ct state related,established counter accept
# Established connections allowed
add rule ip6 filter OUTPUT ct state related,established counter accept
add rule {{_tn6}} OUTPUT ct state related,established counter accept
# allow dhcp6d from aws
add rule ip6 filter INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept
add rule {{_tn6}} INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept
# if the blocked_ips is defined - drop them
{% if blocked_ip_v6 is defined %}
{% for ip in blocked_ip_v6 %}
add rule ip6 filter INPUT ip6 saddr {{ ip }} counter drop
add rule {{_tn6}} INPUT ip6 saddr {{ ip }} counter drop
{% endfor %}
{% endif %}
# allow ssh - always
add rule ip6 filter INPUT ct state new tcp dport 22 counter accept
# for nrpe (if we want noc02 to be able to get into remote systems)
#add rule ip6 filter INPUT ip6 saddr 2600:2701:4000:5211:dead:beef:fe:fed9 tcp dport 5666 counter accept
add rule {{_tn6}} INPUT ct state new tcp dport 22 counter accept
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule ip6 filter INPUT tcp dport {{ port }} counter accept
add rule {{_tn6}} INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule ip6 filter INPUT udp dport {{ port }} counter accept
add rule {{_tn6}} INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
@ -54,5 +57,5 @@ add rule ip6 filter INPUT udp dport {{ port }} counter accept
{% endif %}
# otherwise kick everything out
add rule ip6 filter INPUT counter reject with icmpv6 type admin-prohibited
add rule ip6 filter FORWARD counter reject with icmpv6 type admin-prohibited
add rule {{_tn6}} INPUT counter reject with icmpv6 type admin-prohibited
add rule {{_tn6}} FORWARD counter reject with icmpv6 type admin-prohibited

184
roles/base/templates/nftables/nftables.bastion
View file

@ -1,166 +1,68 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# allow ping and traceroute
add rule ip filter INPUT ip protocol icmp counter accept
{% include '_nft_accept_beg' %}
# localhost is fine
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_std' %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
{% include '_nft_accept_ssh' %}
# allow ssh - always
add rule ip filter INPUT ct state new tcp dport 22 counter accept
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# add rdu3 ips
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# zabbix01
add rule ip filter INPUT tcp dport 10051 counter accept
add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept
{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %}
#
# In the rdu3 datacenter, both production and staging hosts are in different
# vlans, and different subnets. However, just as a precaution, we want prod machines to
# reject connections from any staging host just in case there's some globally enabled port.
# There are however a few hosts in production we have marked 'staging-friendly'
# that we do allow staging to talk to for mostly read-only data they need.
#
add rule ip filter INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited
add rule ip filter INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited
{% endif %}
{% if vpn %}
#
# We want to have all vpn hosts reject most things from the 'less secure' vpn network
#
{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %}
# Allow all vpn hosts to talk to the log server for rsyslog
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept
{% endif %}
{% if inventory_hostname in groups['ipa'] %}
# Allow all vpn hosts to talk to the ipa servers for auth
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept
add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept
{% endif %}
# Reject all further connections from less secure vpn
add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
{% endif %}
{% include '_nft_accept_monitoring' %}
# smtp rules we want to allow vpn and out internal networks and mimecast
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept
# This rejects all VPN traffic at the end. 192.168.100.0/24
{% include '_nft_accept_vpn' %}
{% include '_nft_accept_staging_friends' %}
add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept
{% if datacenter == 'rdu3' %}
# Greg: This is a nasty hack and we need to fix it properly after the DC move, but right
# now I don't see where we'd get the right ip/netmask from in vars
add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept
{% else %}
add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept
{% endif %}
# s390x builders/virthost
add rule ip filter INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept
# redhat mxes
add rule ip filter INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept
# mimecast ips from
# https://community.mimecast.com/s/article/email-security-cloud-gateway-data-centers-and-urls?r=297&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1
add rule ip filter INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept
add rule ip filter INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept
add rule {{_tn}} INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept
{% if nft_block_rules is defined %}
# if there are block rules - put them in as-is
{% for rule in nft_block_rules %}
{{ rule }}
{% endfor %}
{% endif %}
{% include '_nft_block_rules' %}
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% include '_nft_accept_ports' %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% include '_nft_accept_proxy_ports' %}
# if there are any proxy-only tcp_ports - allow them
{% if proxy_tcp_ports is defined %}
{% for port in proxy_tcp_ports %}
{% for proxy in (groups['proxies'] + groups['proxies_internal']) %}
{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %}
add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% else %}
add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% endif %}
{% endfor %}
# nagios
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% include '_nft_custom_rules' %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
{% include '_nft_accept_end' %}
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
{% set _nft_prio_preroute = "-100" %}
{% set _nft_prio_input = "100" %}
{% set _nft_prio_output = "-100" %}
{% set _nft_prio_postroute = "100" %}
{% if nft_nat_rules is defined %}
add table ip nat
add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; }
add chain ip nat INPUT { type nat hook input priority 100; policy accept; }
add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; }
add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; }
{% for rule in nft_nat_rules %}
{{ rule }}
{% endfor %}
{% endif %}
{% include '_nft_nat' %}

270
roles/base/templates/nftables/nftables.kojibuilder
View file

@ -1,28 +1,9 @@
# {{ ansible_managed }}
# Setup an ip filter table with default drop policy.
# {{ template_path }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy drop; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy drop; }
{% include '_nft_drop_beg' %}
# Std. allow rules for the drop policy
# loopback allowed
add rule ip filter INPUT iifname "lo" counter accept
add rule ip filter OUTPUT oifname "lo" counter accept
add rule ip filter INPUT iifname "virbr0" counter accept
add rule ip filter OUTPUT oifname "virbr0" counter accept
add rule ip filter INPUT ip daddr 127.0.0.0/8 counter accept
add rule ip filter OUTPUT ip daddr 127.0.0.0/8 counter accept
# Accept ping and traceroute (needs icmp)
add rule ip filter INPUT ip protocol icmp counter accept
add rule ip filter OUTPUT ip protocol icmp counter accept
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
{% include '_nft_drop_std' %}
{% include '_nft_blocked_ips' %}
@ -31,9 +12,9 @@ add rule ip filter OUTPUT ct state related,established counter accept
#!# WARNING: This is very different...
# -A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT
add set ip filter osbuildapi { type ipv4_addr ; size 65536; }
add set {{_tn}} osbuildapi { type ipv4_addr ; size 65536; }
add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept
add rule {{_tn}} OUTPUT tcp dport 443 ip daddr @osbuildapi accept
# Then in the update script...
# nft flush set global osbuildapi
@ -46,57 +27,57 @@ add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept
# kojipkgs
{% if host in groups['buildvm_s390x'] %}
add rule ip filter OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept
{% endif %}
# tang for buildhw
add rule ip filter OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept
# DNS
add rule ip filter OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept
# bastion smtp
add rule ip filter OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept
# infra.fp.o
add rule ip filter OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept
# rsyslog out to log01
add rule ip filter OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept
# SSH
add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept
add rule ip filter OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept
# add rdu3 ansible control host for now
add rule ip filter INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept
# End of RDU3
{% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %}
# Allow SSHFS binding to koji01
add rule ip filter OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept
{% endif %}
{% if inventory_hostname in groups['secureboot'] %}
# Allow secure boot signing to contact the sign bridge
add rule ip filter OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept
{% endif %}
# http to pull sources from pkgs lookaside
#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept
#add rule {{_tn}} OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept
# https git on pagure,io
add rule ip filter OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept
# IP Helper:
# 10.3. = .iad2.
@ -124,89 +105,89 @@ add rule ip filter OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept
# admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10)
{% if host in groups['staging'] %}
add rule ip filter OUTPUT ip daddr 10.16.166.74 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.74 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.75 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.75 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.74 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.74 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.75 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.75 tcp dport 443 counter accept
{% endif %}
add rule ip filter OUTPUT ip daddr 10.16.163.74 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.74 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.75 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.75 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.76 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.76 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.77 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.77 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.74 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.74 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.75 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.75 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.76 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.76 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.77 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.77 tcp dport 443 counter accept
{% if host in groups['rdu3_staging'] %}
# ipa client ports
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept
# rdu3
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept
{% elif host in groups['rdu3_production'] %}
# rdu3 ports
add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 80 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 443 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 389 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 636 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 88 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 464 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 53 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 80 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 443 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 389 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 636 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 88 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 464 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 53 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept
{% endif %}
{% if host in groups['staging'] %}
@ -214,44 +195,33 @@ add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept
# ****
# NOTE: There is NO koji01.stg.rdu3.fedoraproject.org YET
# ****
add rule ip filter INPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept
add rule ip filter OUTPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept
add rule {{_tn}} INPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept
{% endif %}
# NFS for rdu3
# a little to wide-open - but kinda necessary
add rule ip filter INPUT ip saddr 10.16.162.11 counter accept
add rule ip filter OUTPUT ip daddr 10.16.162.11 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.162.11 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.162.11 counter accept
#!# NOTE: tcp/udp doesn't translate without a port??
add rule ip filter INPUT ip saddr 10.16.162.12 counter accept
add rule ip filter OUTPUT ip daddr 10.16.162.12 counter accept
add rule ip filter INPUT ip saddr 10.16.162.13 counter accept
add rule ip filter OUTPUT ip daddr 10.16.162.13 counter accept
add rule ip filter INPUT ip saddr 10.16.162.14 counter accept
add rule ip filter OUTPUT ip daddr 10.16.162.14 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.162.12 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.162.12 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.162.13 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.162.13 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.162.14 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.162.14 counter accept
# ntp
add rule ip filter OUTPUT ip daddr 10.16.163.31 udp dport 123 counter accept
add rule ip filter OUTPUT ip daddr 10.16.163.32 udp dport 123 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 udp dport 123 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.32 udp dport 123 counter accept
# dhcp
add rule ip filter OUTPUT ip daddr 10.16.163.10 udp dport 67 counter accept
add rule {{_tn}} OUTPUT ip daddr 10.16.163.10 udp dport 67 counter accept
# s390x builders ssh
add rule ip filter INPUT ip saddr 10.16.0.0/16 tcp dport 22 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.0.0/16 tcp dport 22 counter accept
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% include '_nft_accept_ports' %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
# if there are custom rules - put them in as-is
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% include '_nft_custom_rules' %}

61
roles/base/templates/nftables/nftables.osuosl
View file

@ -1,63 +1,22 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# allow ping and traceroute
add rule ip filter INPUT ip protocol icmp counter accept
{% include '_nft_accept_beg' %}
# localhost is fine
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_std' %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
add rule ip filter INPUT ip saddr {{ ip }} counter drop
{% endfor %}
{% endif %}
{% include '_nft_blocked_ips' %}
# allow ssh only from needed ips
# vpn in from tun0
add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept
add rule {{_tn}} INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept
# external ip for rdu3
add rule ip filter INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept
add rule {{_tn}} INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
{% include '_nft_accept_monitoring' %}
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% include '_nft_accept_ports' %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% include '_nft_custom_rules' %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
{% include '_nft_accept_end' %}

94
roles/base/templates/nftables/nftables.releng
View file

@ -1,92 +1,50 @@
# {{ ansible_managed }}
# {{ template_path }}
#
# NOTE: Chaging this template updates iptables on all releng hosts :)
# Please check with sysadmin-main before pushing out an update here.
#
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy drop; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# loopback allowed
add rule ip filter INPUT iifname "lo" counter accept
# NOTE: We don't use _nft_accept_beg because INPUT policy default is drop
# Accept ping and traceroute (needs icmp)
add rule ip filter INPUT ip protocol icmp counter accept
# Set small Table Names.
# We need the big global ones so we can use them in *_rules but, that would be
# a lot in these files.
{% set _tn = nft_table_filter %}
{% set _tnat = nft_table_nat %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add table {{_tn}}
add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; }
add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; }
add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; }
# Overwrite any global rules
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# add rdu3 ips
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept
# Zabbix
add rule ip filter INPUT tcp dport 10051 counter accept
add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept
{% include '_nft_accept_std' %}
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
add rule ip filter INPUT ip saddr {{ ip }} counter drop
{% endfor %}
{% endif %}
{% include '_nft_accept_monitoring' %}
{% include '_nft_blocked_ips' %}
# SSH
#!# NOTE: Do we still need/wants these 13+ years later?
# ssh block against uni in .cz where problem(s) have been cited
# added by skvidal on jan 24 2011 - as per request from spot
add rule ip filter INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject
add rule {{_tn}} INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject
# matches last rule for a service we want blocked
add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset
add rule ip filter INPUT tcp dport 22 counter accept
add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset
add rule {{_tn}} INPUT tcp dport 22 counter accept
# Allow all netapp traffic
add rule ip filter INPUT ip saddr 10.16.162.0/24 counter accept
add rule {{_tn}} INPUT ip saddr 10.16.162.0/24 counter accept
{% include '_nft_accept_ssh' %}
# Custom Services
{% include '_nft_accept_http' %}
# Services TCP
add rule ip filter INPUT tcp dport 22 counter accept
add rule ip filter INPUT tcp dport 80 counter accept
add rule ip filter INPUT tcp dport 443 counter accept
{% include '_nft_accept_ports' %}
# Services UDP
{% include '_nft_custom_rules' %}
# more services we use - ports for random services and TG listeners.
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
{% include '_nft_accept_vpn' %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# Extra protection for 192.168.100.x vpn hosts.
add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited
add rule ip filter INPUT counter reject with icmp type host-prohibited
{% include '_nft_accept_end' %}

21
roles/base/templates/nftables/nftables.sign
View file

@ -1,22 +1,11 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# loopback allowed
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_beg' %}
# Accept ping and traceroute (needs icmp)
add rule ip filter INPUT ip protocol icmp counter accept
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
{% include '_nft_accept_std' %}
# Allow connections from client/server
add rule ip filter INPUT tcp dport 44333-44334 counter accept
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
add rule {{_tn}} INPUT tcp dport 44333-44334 counter accept
{% include '_nft_accept_end' %}

66
roles/base/templates/nftables/nftables.staging
View file

@ -1,53 +1,20 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# allow ping and traceroute
add rule ip filter INPUT ip protocol icmp counter accept
{% include '_nft_accept_beg' %}
# localhost is fine
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_std' %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
{% include '_nft_accept_ssh' %}
# allow ssh - always
add rule ip filter INPUT ct state new tcp dport 22 counter accept
{% include '_nft_accept_monitoring' %}
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
# zabbix01.stg
add rule ip filter INPUT tcp dport 10051 counter accept
add rule ip filter INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept
{% include '_nft_block_rules' %}
{% if nft_block_rules is defined %}
# if there are block rules - put them in as-is
{% for rule in nft_block_rules %}
{{ rule }}
{% endfor %}
{% endif %}
{% include '_nft_accept_ports' %}
# if the host/group defines incoming tcp_ports - allow them
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
# if the host/group defines incoming udp_ports - allow them
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
# NOTE: This uses proxies_stg and not proxies. Also the VPN bits. ... so unique
# version of '_nft_accept_proxy_ports'
# if there are any proxy-only tcp_ports - allow them
{% if proxy_tcp_ports is defined %}
@ -55,24 +22,17 @@ add rule ip filter INPUT udp dport {{ port }} counter accept
{% for proxy in groups['proxies_stg'] %}
{% if hostvars[proxy]['vpn'] %}
#!# FIXME: This test is the negation of the one in iptables.
add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% else %}
add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept
{% endif %}
{% endfor %}
# No nagios
{% endfor %}
{% endif %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
{% include '_nft_custom_rules' %}
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
{% include '_nft_accept_end' %}
# No nat rules

70
roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org
View file

@ -1,42 +1,23 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# allow ping and traceroute
add rule ip filter INPUT ip protocol icmp counter accept
{% include '_nft_accept_beg' %}
# localhost is fine
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_std' %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
{% include '_nft_accept_ssh' %}
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
add rule ip filter INPUT ip saddr {{ ip }} counter drop
{% endfor %}
{% endif %}
{% include '_nft_accept_monitoring' %}
# allow ssh - always
add rule ip filter INPUT ct state new tcp dport 22 counter accept
{% include '_nft_blocked_ips' %}
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
# NOTE: we don't allow 10.16.163.10 / 10.16.166.10 or zabbix?
# NOTE: This is _nft_accept_ports but with special variables.
# if the host/group defines incoming tcp_ports - allow them
# NOTE: These are specific to eth0
{% if tcp_ports_eth0 is defined %}
{% for port in tcp_ports_eth0 %}
add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept
add rule {{_tn}} INPUT iifname "eth0" tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
@ -44,7 +25,7 @@ add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept
# NOTE: These are specific to eth0
{% if udp_ports_eth0 is defined %}
{% for port in udp_ports_eth0 %}
add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept
add rule {{_tn}} INPUT iifname "eth0" udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
@ -52,7 +33,7 @@ add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept
# NOTE: These are specific to eth1
{% if tcp_ports_eth1 is defined %}
{% for port in tcp_ports_eth1 %}
add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept
add rule {{_tn}} INPUT iifname "eth1" tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
@ -60,30 +41,19 @@ add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept
# NOTE: These are specific to eth1
{% if udp_ports_eth1 is defined %}
{% for port in udp_ports_eth1 %}
add rule ip filter INPUT iifname "eth1" udp dport {{ port }} counter accept
add rule {{_tn}} INPUT iifname "eth1" udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
{% include '_nft_custom_rules' %}
{% if nft_nat_rules %}
#!# FIXME: These are different priority to iptables template...
add table ip nat
add chain ip nat PREROUTING { type nat hook prerouting priority 0; policy accept; }
add chain ip nat INPUT { type nat hook input priority 0; policy accept; }
add chain ip nat OUTPUT { type nat hook output priority 0; policy accept; }
add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; }
{% include '_nft_accept_end' %}
{% for rule in nft_nat_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# Why are these different from nftables??
{% set _nft_prio_preroute = "0" %}
{% set _nft_prio_input = "0" %}
{% set _nft_prio_output = "0" %}
{% set _nft_prio_postroute = "0" %}
{% include '_nft_nat' %}

88
roles/base/templates/nftables/nftables.torrent02.fedoraproject.org
View file

@ -1,87 +1,31 @@
# {{ ansible_managed }}
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; policy accept; }
add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; }
add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; }
# {{ template_path }}
# allow ping and traceroute
add rule ip filter INPUT ip protocol icmp counter accept
{% include '_nft_accept_beg' %}
# localhost is fine
add rule ip filter INPUT iifname "lo" counter accept
{% include '_nft_accept_std' %}
# Established connections allowed
add rule ip filter INPUT ct state related,established counter accept
add rule ip filter OUTPUT ct state related,established counter accept
{% include '_nft_accept_ssh' %}
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}
{% for ip in blocked_ips %}
add rule ip filter INPUT ip saddr {{ ip }} counter drop
{% endfor %}
{% endif %}
{% include '_nft_accept_monitoring' %}
# allow ssh - always
add rule ip filter INPUT ct state new tcp dport 22 counter accept
{% include '_nft_blocked_ips' %}
# for nrpe - allow it from nocs
add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept
# FIXME - this is the global nat-ip and we need the noc01-specific ip
add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept
add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept
# NOTE: This doesn't include 10.16.166.10
# NOTE: This doesn't include zabbix.
{% include '_nft_accept_ports' %}
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging_friendly'] %}
#
# In the phx2 datacenter, both production and staging hosts are in the same
# subnet/vlan. We want production hosts to reject connectons from staging group hosts
# to prevent them from interfering with production. There are however a few hosts in
# production we have marked 'staging-friendly' that we do allow staging to talk to for
# mostly read-only data they need.
#
{% for host in groups['staging']|sort %}
{% if 'eth0_ip' in hostvars[host] %}# {{ host }}
add rule ip filter INPUT ip saddr {{ hostvars[host]['eth0_ip'] }} counter reject with icmp type host-prohibited
{% else %}# {{ host }} has no 'eth0_ip' listed
{% endif %}
{% endfor %}
{% endif %}
{% include '_nft_custom_rules' %}
{% include '_nft_accept_end' %}
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
add rule ip filter INPUT tcp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# This is the special bit for torrents...
{% set _tnr = nft_table_raw %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
add rule ip filter INPUT udp dport {{ port }} counter accept
{% endfor %}
{% endif %}
# if there are custom rules - put them in as-is
{% if nft_custom_rules is defined %}
{% for rule in nft_custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# otherwise kick everything out
add rule ip filter INPUT counter reject with icmp type host-prohibited
add rule ip filter FORWARD counter reject with icmp type host-prohibited
add table ip raw
add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; }
add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; }
add table {{_tnr}}
add chain {{_tnr}} PREROUTING { type filter hook prerouting priority -300; policy accept; }
add chain {{_tnr}} OUTPUT { type filter hook output priority -300; policy accept; }
#
# We don't want to track all the torrent tracker connections, there's too many.
#
add rule ip raw PREROUTING tcp dport 6969 counter notrack
add rule ip raw OUTPUT tcp sport 6969 counter notrack
add rule {{_tnr}} PREROUTING tcp dport 6969 counter notrack
add rule {{_tnr}} OUTPUT tcp sport 6969 counter notrack

14
roles/koji_builder/templates/osbuildapi-update-nft.sh
View file

@ -14,16 +14,16 @@
# 2. Checking if it exists and failing with a "nice" message, if it doesn't.
# 3. Waiting for it to exist.
# if ! nft list set ip filter osbuildapi >& /dev/null; then
# if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then
# exit 0
# fi
if ! nft list set ip filter osbuildapi >& /dev/null; then
echo "OSBUILD: nft set ip filter osbuildapi: Doesn't exist" 1>&2;
if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then
echo "OSBUILD: nft set {{nft_table_filter}} osbuildapi: Doesn't exist" 1>&2;
exit 2
fi
while ! nft list set ip filter osbuildapi >& /dev/null; do
while ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; do
sleep 10
done
@ -47,15 +47,15 @@ NEWIDENTITYIPS=`echo "$RESOLVEQUERY" | grep link | sed -E 's/.* ([0-9]+\.[0-9]+\
# Empty the filter: We do this at the end for a small window.`
# NOTE: We aren't flushing old entries anymore.
# See commit: e7b50aaee469fdded0ea650c7e7f4dd06e929609
# nft flush set ip filter osbuildapi
# nft flush set {{nft_table_filter}} osbuildapi
# Add the IPs...
for j in $NEWIPS
do
nft add element ip filter osbuildapi { $j }
nft add element {{nft_table_filter}} osbuildapi { $j }
done
for j in $NEWIDENTITYIPS
do
nft add element ip filter osbuildapi { $j }
nft add element {{nft_table_filter}} osbuildapi { $j }
done

2
scripts/maint-update-reboot.sh
View file

@ -8,7 +8,7 @@ ssh "$host" dnf --refresh -y up
if [ "$(ssh $host who | wc -l)" = "1" ]; then
ansible -m reboot "$host"
ssh "$host" rkhunter --propupd
ssh "$host" rkhunter --propupd || true
else
echo " ** Skipping reboot as Users on: $host"
fi