diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 8302bf27ee..c98886653e 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -154,6 +154,12 @@ nftables: True nft_custom6_rules: [] nft_custom_rules: [] nft_nat_rules: [] +# Table names for nft +# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets. +nft_table_filter: "ip cle_infra_filter" +nft_table_nat: "ip cle_infra_nat" +nft_table_raw: "ip cle_infra_raw" +nft_table6_filter: "ip6 cle_infra_filter" # usually we do not want to enable nested virt, only on some virthosts nested: false network_allow_restart: yes diff --git a/inventory/group_vars/autosign b/inventory/group_vars/autosign index 02cd91ccd1..73f28d9e59 100644 --- a/inventory/group_vars/autosign +++ b/inventory/group_vars/autosign @@ -10,7 +10,7 @@ ansible_ifcfg_allowlist: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/autosign_hardware b/inventory/group_vars/autosign_hardware index b4c54b6aeb..27344fac30 100644 --- a/inventory/group_vars/autosign_hardware +++ b/inventory/group_vars/autosign_hardware @@ -2,5 +2,5 @@ # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign diff --git a/inventory/group_vars/bastion b/inventory/group_vars/bastion index 6765f217f6..f399bf1571 100644 --- a/inventory/group_vars/bastion +++ b/inventory/group_vars/bastion @@ -8,8 +8,8 @@ # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bastion_stg b/inventory/group_vars/bastion_stg index f7d3fbdbc1..7aa56d1ddc 100644 --- a/inventory/group_vars/bastion_stg +++ b/inventory/group_vars/bastion_stg @@ -19,8 +19,8 @@ batcave_ipa_client_shell_groups: [] # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' ipa_client_shell_groups: "{{ (bastion_ipa_client_shell_groups + batcave_ipa_client_shell_groups) | sort | unique }}" # # allow a bunch of sysadmin groups here so they can access internal stuff diff --git a/inventory/group_vars/batcave b/inventory/group_vars/batcave index eb86f03654..b5dfb59109 100644 --- a/inventory/group_vars/batcave +++ b/inventory/group_vars/batcave @@ -4,8 +4,8 @@ ansible_base: /srv/web/infra # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bodhi_backend b/inventory/group_vars/bodhi_backend index 5e58673e3b..c0b4170202 100644 --- a/inventory/group_vars/bodhi_backend +++ b/inventory/group_vars/bodhi_backend @@ -7,7 +7,7 @@ bodhi_message_routing_keys: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/bodhi_backend_stg b/inventory/group_vars/bodhi_backend_stg index 3a8266fd26..e9f7b60028 100644 --- a/inventory/group_vars/bodhi_backend_stg +++ b/inventory/group_vars/bodhi_backend_stg @@ -9,7 +9,7 @@ bodhi_message_routing_keys: # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 # this is sign-bridge01.rdu3 ip 10.16.169.120 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/certgetter b/inventory/group_vars/certgetter index d4988816fb..c1710af73f 100644 --- a/inventory/group_vars/certgetter +++ b/inventory/group_vars/certgetter @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/certgetter_stg b/inventory/group_vars/certgetter_stg index 177cf1b29b..0f6bf890d9 100644 --- a/inventory/group_vars/certgetter_stg +++ b/inventory/group_vars/certgetter_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index 2dd7d4013e..6baf31d963 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -47,13 +47,13 @@ nbde_client_bindings: libvirt_host: "{{ inventory_hostname }}" nft_custom_rules: - - add rule ip filter INPUT iifname virbr0 udp dport bootps accept - - add rule ip filter INPUT iifname virbr0 udp dport 53 accept - - add rule ip filter INPUT iifname virbr0 tcp dport ssh accept - - add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept - - add rule ip filter FORWARD iifname "virbr0" ct state new counter accept - - add rule ip filter FORWARD ct state established,related counter accept - - add rule ip filter FORWARD ip protocol icmp counter accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept + - add rule {{nft_table_filter}} FORWARD ct state established,related counter accept + - add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept zabbix_macros: CPU.UTIL.CRIT: 100 diff --git a/inventory/group_vars/copr_keygen_aws b/inventory/group_vars/copr_keygen_aws index d5c426591b..e94a546e1a 100644 --- a/inventory/group_vars/copr_keygen_aws +++ b/inventory/group_vars/copr_keygen_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/copr_keygen_dev_aws b/inventory/group_vars/copr_keygen_dev_aws index e64237e875..33308f4ee9 100644 --- a/inventory/group_vars/copr_keygen_dev_aws +++ b/inventory/group_vars/copr_keygen_dev_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 272948f7d0..1b63373ace 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -115,7 +115,7 @@ ipa_host_group_desc: Download servers nagios_Check_Services: swap: false nft_block_rules: - - 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject' primary_auth_source: ipa zabbix_macros: 'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status diff --git a/inventory/group_vars/ipa b/inventory/group_vars/ipa index 0c023273a0..71f0c59e3d 100644 --- a/inventory/group_vars/ipa +++ b/inventory/group_vars/ipa @@ -1,7 +1,7 @@ --- # Define resources for this group of hosts here. custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG'] ipa_client_shell_groups: - sysadmin-accounts diff --git a/inventory/group_vars/ipatuura_stg b/inventory/group_vars/ipatuura_stg index 3d09c4e75e..90d5d20b90 100644 --- a/inventory/group_vars/ipatuura_stg +++ b/inventory/group_vars/ipatuura_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipatuura ipa_host_group_desc: IPA-tuura SCIM application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon b/inventory/group_vars/ipsilon index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon +++ b/inventory/group_vars/ipsilon @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_rdu3 b/inventory/group_vars/ipsilon_rdu3 index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon_rdu3 +++ b/inventory/group_vars/ipsilon_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_stg b/inventory/group_vars/ipsilon_stg index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg +++ b/inventory/group_vars/ipsilon_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon_stg_rdu3 b/inventory/group_vars/ipsilon_stg_rdu3 index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg_rdu3 +++ b/inventory/group_vars/ipsilon_stg_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/kernel_qa b/inventory/group_vars/kernel_qa index 593edfd488..cfee9501db 100644 --- a/inventory/group_vars/kernel_qa +++ b/inventory/group_vars/kernel_qa @@ -1,6 +1,6 @@ --- custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] freezes: false ipa_client_shell_groups: - sysadmin-kernel diff --git a/inventory/group_vars/koji b/inventory/group_vars/koji index 9f9b351aee..ec25cd2d60 100644 --- a/inventory/group_vars/koji +++ b/inventory/group_vars/koji @@ -5,8 +5,8 @@ custom_rules: [ '-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT'] # Needed for keepalived nft_custom_rules: - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' docker_registry: "candidate-registry.fedoraproject.org" ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/kojipkgs b/inventory/group_vars/kojipkgs index b8e6a711bb..e73a655f8a 100644 --- a/inventory/group_vars/kojipkgs +++ b/inventory/group_vars/kojipkgs @@ -6,8 +6,8 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] # Need for rsync from log01 for logs. nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_client_shell_groups: - sysadmin-noc - sysadmin-releng diff --git a/inventory/group_vars/openqa_tap_workers b/inventory/group_vars/openqa_tap_workers index ca322db3e0..7fb7eacf15 100644 --- a/inventory/group_vars/openqa_tap_workers +++ b/inventory/group_vars/openqa_tap_workers @@ -2,9 +2,9 @@ # uses interface definition from host vars custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter FORWARD iifname "br0" counter accept' - - 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' - - 'add rule ip filter INPUT iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' + - 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept' # for iptables rules...maybe other stuff in future? both staging # and prod workers are in this group host_group: openqa-tap-workers diff --git a/inventory/group_vars/os_proxies b/inventory/group_vars/os_proxies index 97579daf6a..6d857ed86c 100644 --- a/inventory/group_vars/os_proxies +++ b/inventory/group_vars/os_proxies @@ -6,10 +6,10 @@ custom_rules: [ '-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT'] nft_custom_rules: # Needed for keepalived - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' # machinectl api - - 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' datacenter: cloud host_group: cloud lvm_size: 20000 diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index 486557be40..9606270220 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -8,35 +8,35 @@ custom_rules: [ '-A INPUT -s 47.76.99.127/32 -j REJECT' ] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject' # For the MOTD db_backup_dir: ['/backups'] dbs_to_backup: ['pagure'] diff --git a/inventory/group_vars/people b/inventory/group_vars/people index 0d8398988a..2bb85c5fc1 100644 --- a/inventory/group_vars/people +++ b/inventory/group_vars/people @@ -6,7 +6,7 @@ clamscan_paths: # For the MOTD # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] git_basepath: / git_daemon_user: nobody git_port: 9418 diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 3984cea0e4..2bf758e66a 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -34,91 +34,91 @@ custom_rules: [ '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject' - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' - - 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject' - - 'add rule ip filter INPUT ip saddr 208.78.212.5/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 208.78.212.5/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/proxies_stg b/inventory/group_vars/proxies_stg index 3e020a7b6f..e19035b1b5 100644 --- a/inventory/group_vars/proxies_stg +++ b/inventory/group_vars/proxies_stg @@ -11,44 +11,44 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/rabbitmq b/inventory/group_vars/rabbitmq index c8521a8998..ea590e3e62 100644 --- a/inventory/group_vars/rabbitmq +++ b/inventory/group_vars/rabbitmq @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/rabbitmq_stg b/inventory/group_vars/rabbitmq_stg index c49e840c32..de7aae5d30 100644 --- a/inventory/group_vars/rabbitmq_stg +++ b/inventory/group_vars/rabbitmq_stg @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/retrace b/inventory/group_vars/retrace index e8ee077ab2..345b9d6322 100644 --- a/inventory/group_vars/retrace +++ b/inventory/group_vars/retrace @@ -3,8 +3,8 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' env: production freezes: false ipa_client_shell_groups: diff --git a/inventory/group_vars/value b/inventory/group_vars/value index 6321063d96..9e794d8352 100644 --- a/inventory/group_vars/value +++ b/inventory/group_vars/value @@ -10,13 +10,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Needed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: prod ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/value_stg b/inventory/group_vars/value_stg index 02e65cdfdf..b6c3cea5ba 100644 --- a/inventory/group_vars/value_stg +++ b/inventory/group_vars/value_stg @@ -10,14 +10,14 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: stg ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org index 593c7e5fbe..795abe9429 100644 --- a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org @@ -4,17 +4,17 @@ # nft_custom_rules: # Openshift nodes (egress policy will block connection from non-authorized projects) - - 'add rule ip filter INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' # noc01 needs to connect to check the db - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # Ipsilon VMs - - 'add rule ip filter INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org index c8b25167e0..6cacb03829 100644 --- a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ # # TODO: lock it down more nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org index d74bf88646..7be7e3184b 100644 --- a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org @@ -3,10 +3,10 @@ # Only allow postgresql access from the frontend node. # nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org index 7c0ad3f451..2b120673a3 100644 --- a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # Only allow postgresql access from the frontend node. # -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org index 332c62b5a6..ddfa86353d 100644 --- a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # This is a generic list, monitored by collectd custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.172.21 --dport 5432 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' databases: - koji datacenter: rdu3 diff --git a/inventory/host_vars/db01.rdu3.fedoraproject.org b/inventory/host_vars/db01.rdu3.fedoraproject.org index a2e97104fe..20973a7902 100644 --- a/inventory/host_vars/db01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - anitya diff --git a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org index c8ade85061..687ac8513e 100644 --- a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - askfedora diff --git a/inventory/host_vars/noc01.rdu3.fedoraproject.org b/inventory/host_vars/noc01.rdu3.fedoraproject.org index f8b1f05238..53e7ab1f17 100644 --- a/inventory/host_vars/noc01.rdu3.fedoraproject.org +++ b/inventory/host_vars/noc01.rdu3.fedoraproject.org @@ -6,13 +6,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT' ] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' # needed to allow rsync from log01 - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # needed to allow 8080 (firmware-proxy from iDRAC mgmt vlans - - 'add rule ip filter INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.10 diff --git a/roles/base/templates/nftables/_nft_accept_beg b/roles/base/templates/nftables/_nft_accept_beg new file mode 100644 index 0000000000..aa5c8f2236 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_beg @@ -0,0 +1,14 @@ +# {{ ansible_managed }} +# _nft_accept_beg +# Setup an ip filter table with default accept policy, and the std. allow rules. + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } diff --git a/roles/base/templates/nftables/_nft_accept_end b/roles/base/templates/nftables/_nft_accept_end new file mode 100644 index 0000000000..da906e3462 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_end @@ -0,0 +1,7 @@ +# _nft_accept_end +# Default accept policy, standard end rules +# This kind of makes it default drop, but the spelling is weird. + +# otherwise kick everything out +add rule {{_tn}} INPUT counter reject with icmp type host-prohibited +add rule {{_tn}} FORWARD counter reject with icmp type host-prohibited diff --git a/roles/base/templates/nftables/_nft_accept_http b/roles/base/templates/nftables/_nft_accept_http new file mode 100644 index 0000000000..564243a11c --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_http @@ -0,0 +1,6 @@ +# _nft_accept_http +# Accept HTTP(s) + +add rule {{_tn}} INPUT ct state new tcp dport 80 counter accept +add rule {{_tn}} INPUT ct state new tcp dport 443 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring new file mode 100644 index 0000000000..b24676659b --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -0,0 +1,15 @@ +# _nft_accept_monitoring +# Default accept policy, let things be monitored + +# for nrpe - allow it from nocs +#add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept +#add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept +# FIXME - this is the global nat-ip and we need the noc01-specific ip +add rule {{_tn}} INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept +# zabbix01 +add rule {{_tn}} INPUT tcp dport 10051 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_ports b/roles/base/templates/nftables/_nft_accept_ports new file mode 100644 index 0000000000..0583fb9104 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ports @@ -0,0 +1,16 @@ +# _nft_accept_ports +# Default accept policy, accept host defined tcp/udp ports + +# if the host/group defines incoming tcp_ports - allow them +{% if tcp_ports is defined %} +{% for port in tcp_ports %} +add rule {{_tn}} INPUT tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} + +# if the host/group defines incoming udp_ports - allow them +{% if udp_ports is defined %} +{% for port in udp_ports %} +add rule {{_tn}} INPUT udp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_proxy_ports b/roles/base/templates/nftables/_nft_accept_proxy_ports new file mode 100644 index 0000000000..24f8c14037 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_proxy_ports @@ -0,0 +1,17 @@ +# _nft_accept_proxy_ports +# Default accept policy, deal with proxy ports (if defined) + +# if there are any proxy-only tcp_ports - allow them +{% if proxy_tcp_ports is defined %} +{% for port in proxy_tcp_ports %} +{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} +{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% else %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% endif %} +{% endfor %} +# nagios +add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_ssh b/roles/base/templates/nftables/_nft_accept_ssh new file mode 100644 index 0000000000..24f0093058 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ssh @@ -0,0 +1,6 @@ +# _nft_accept_ssh +# Accept ssh + +# allow ssh - always +add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_staging_friends b/roles/base/templates/nftables/_nft_accept_staging_friends new file mode 100644 index 0000000000..f7fd1a0a56 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_staging_friends @@ -0,0 +1,13 @@ +# _nft_accept_staging_friends + +{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} +# +# In the rdu3 datacenter, both production and staging hosts are in different +# vlans, and different subnets. However, just as a precaution, we want prod machines to +# reject connections from any staging host just in case there's some globally enabled port. +# There are however a few hosts in production we have marked 'staging-friendly' +# that we do allow staging to talk to for mostly read-only data they need. +# +add rule {{_tn}} INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_std b/roles/base/templates/nftables/_nft_accept_std new file mode 100644 index 0000000000..493da9a8ae --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_std @@ -0,0 +1,12 @@ +# _nft_accept_std +# Standard accept lines, SSH is _not_ here. + +# allow ping and traceroute +add rule {{_tn}} INPUT ip protocol icmp counter accept + +# localhost is fine +add rule {{_tn}} INPUT iifname "lo" counter accept + +# Established connections allowed +add rule {{_tn}} INPUT ct state related,established counter accept +add rule {{_tn}} OUTPUT ct state related,established counter accept diff --git a/roles/base/templates/nftables/_nft_accept_vpn b/roles/base/templates/nftables/_nft_accept_vpn new file mode 100644 index 0000000000..7af23698e1 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_vpn @@ -0,0 +1,30 @@ +# _nft_accept_vpn +# Default accept policy, vpn stuff. +# NOTE: That the end of this file rejects all other VPN traffic. + +{% if vpn %} +# +# We want to have all vpn hosts reject most things from the 'less secure' vpn network +# +{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %} +# Allow all vpn hosts to talk to the log server for rsyslog +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept +{% endif %} + +{% if inventory_hostname in groups['ipa'] %} +# Allow all vpn hosts to talk to the ipa servers for auth +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept + +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept +{% endif %} + +# Reject all further connections from less secure vpn +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/_nft_block_rules b/roles/base/templates/nftables/_nft_block_rules new file mode 100644 index 0000000000..1e78f98ba3 --- /dev/null +++ b/roles/base/templates/nftables/_nft_block_rules @@ -0,0 +1,9 @@ +# _nft_block_rules +# Default accept policy, standard end rules + +{% if nft_block_rules is defined %} +# if there are block rules - put them in as-is +{% for rule in nft_block_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_blocked_ips b/roles/base/templates/nftables/_nft_blocked_ips index bb8f4df77a..f55aaad6dd 100644 --- a/roles/base/templates/nftables/_nft_blocked_ips +++ b/roles/base/templates/nftables/_nft_blocked_ips @@ -4,7 +4,6 @@ # if the blocked_ips is defined - drop them {% if blocked_ips is defined %} {% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop +add rule {{_tn}} INPUT ip saddr {{ ip }} counter drop {% endfor %} {% endif %} - diff --git a/roles/base/templates/nftables/_nft_custom_rules b/roles/base/templates/nftables/_nft_custom_rules new file mode 100644 index 0000000000..bf63274c8a --- /dev/null +++ b/roles/base/templates/nftables/_nft_custom_rules @@ -0,0 +1,9 @@ +# _nft_custom_rules +# Probably only use for: Default accept policy + +# if there are custom rules - put them in as-is +{% if nft_custom_rules is defined %} +{% for rule in nft_custom_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_drop_beg b/roles/base/templates/nftables/_nft_drop_beg new file mode 100644 index 0000000000..3663d11ed4 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_beg @@ -0,0 +1,17 @@ +# {{ ansible_managed }} +# _nft_drop_beg +# Setup an ip filter table with default drop policy. +# +# Note that there's no _nft_drop_end because _nft_accept_end drops everything +# and we don't need that. + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy drop; } diff --git a/roles/base/templates/nftables/_nft_drop_std b/roles/base/templates/nftables/_nft_drop_std new file mode 100644 index 0000000000..f0bbb6dee1 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_std @@ -0,0 +1,12 @@ +# _nft_drop_std +# Std. allow rules for the drop policy + + +{% include '_nft_accept_std' %} + +# MORE loopback allowed +add rule {{_tn}} OUTPUT oifname "lo" counter accept +add rule {{_tn}} INPUT iifname "virbr0" counter accept +add rule {{_tn}} OUTPUT oifname "virbr0" counter accept +add rule {{_tn}} INPUT ip daddr 127.0.0.0/8 counter accept +add rule {{_tn}} OUTPUT ip daddr 127.0.0.0/8 counter accept diff --git a/roles/base/templates/nftables/_nft_nat b/roles/base/templates/nftables/_nft_nat new file mode 100644 index 0000000000..f185cb2a4e --- /dev/null +++ b/roles/base/templates/nftables/_nft_nat @@ -0,0 +1,15 @@ +# _nft_nat +# Setup forwarding via. "ip nat" table, if we have nat rules. + +{% if nft_nat_rules is defined %} + +add table {{_tnat}} +add chain {{_tnat}} PREROUTING { type nat hook prerouting priority {{_nft_prio_preroute}}; policy accept; } +add chain {{_tnat}} INPUT { type nat hook input priority {{_nft_prio_input}}; policy accept; } +add chain {{_tnat}} OUTPUT { type nat hook output priority {{_nft_prio_output}}; policy accept; } +add chain {{_tnat}} POSTROUTING { type nat hook postrouting priority {{_nft_prio_postroute}}; policy accept; } + +{% for rule in nft_nat_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index 6558908491..8d96da9f4c 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -1,128 +1,32 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_monitoring' %} -# rdu3 -# for nrpe - allow it from nocs -#add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -#add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_vpn' %} -{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the rdu3 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_staging_friends' %} -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept +{% include '_nft_block_rules' %} -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_ports' %} + +{% include '_nft_accept_proxy_ports' %} + +{% include '_nft_custom_rules' %} + +{% include '_nft_accept_end' %} -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% set _nft_prio_preroute = "-100" %} +{% set _nft_prio_input = "100" %} +{% set _nft_prio_output = "-100" %} +{% set _nft_prio_postroute = "100" %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables-ipv6 b/roles/base/templates/nftables/nftables-ipv6 index c1fa235ccf..09dc65915e 100644 --- a/roles/base/templates/nftables/nftables-ipv6 +++ b/roles/base/templates/nftables/nftables-ipv6 @@ -1,48 +1,51 @@ # {{ ansible_managed }} -add table ip6 filter -add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; } + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn6 = nft_table6_filter %} + +add table {{_tn6}} +add chain {{_tn6}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn6}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn6}} OUTPUT { type filter hook output priority 0; policy accept; } # loopback allowed -add rule ip6 filter INPUT iifname "lo" counter accept +add rule {{_tn6}} INPUT iifname "lo" counter accept # Accept ping and traceroute (needs icmp) -add rule ip6 filter INPUT meta l4proto ipv6-icmp counter accept +add rule {{_tn6}} INPUT meta l4proto ipv6-icmp counter accept # Established connections allowed -add rule ip6 filter INPUT ct state related,established counter accept +add rule {{_tn6}} INPUT ct state related,established counter accept # Established connections allowed -add rule ip6 filter OUTPUT ct state related,established counter accept +add rule {{_tn6}} OUTPUT ct state related,established counter accept # allow dhcp6d from aws -add rule ip6 filter INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept +add rule {{_tn6}} INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept # if the blocked_ips is defined - drop them {% if blocked_ip_v6 is defined %} {% for ip in blocked_ip_v6 %} -add rule ip6 filter INPUT ip6 saddr {{ ip }} counter drop +add rule {{_tn6}} INPUT ip6 saddr {{ ip }} counter drop {% endfor %} {% endif %} # allow ssh - always -add rule ip6 filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe (if we want noc02 to be able to get into remote systems) -#add rule ip6 filter INPUT ip6 saddr 2600:2701:4000:5211:dead:beef:fe:fed9 tcp dport 5666 counter accept +add rule {{_tn6}} INPUT ct state new tcp dport 22 counter accept # if the host/group defines incoming tcp_ports - allow them {% if tcp_ports is defined %} {% for port in tcp_ports %} -add rule ip6 filter INPUT tcp dport {{ port }} counter accept +add rule {{_tn6}} INPUT tcp dport {{ port }} counter accept {% endfor %} {% endif %} # if the host/group defines incoming udp_ports - allow them {% if udp_ports is defined %} {% for port in udp_ports %} -add rule ip6 filter INPUT udp dport {{ port }} counter accept +add rule {{_tn6}} INPUT udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -54,5 +57,5 @@ add rule ip6 filter INPUT udp dport {{ port }} counter accept {% endif %} # otherwise kick everything out -add rule ip6 filter INPUT counter reject with icmpv6 type admin-prohibited -add rule ip6 filter FORWARD counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} INPUT counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} FORWARD counter reject with icmpv6 type admin-prohibited diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index 770674ec9c..f3a3cde524 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -1,166 +1,68 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# add rdu3 ips -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept - -{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the rdu3 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited -{% endif %} - -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.rdu3.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept - -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_monitoring' %} # smtp rules we want to allow vpn and out internal networks and mimecast -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept + +# This rejects all VPN traffic at the end. 192.168.100.0/24 +{% include '_nft_accept_vpn' %} + +{% include '_nft_accept_staging_friends' %} + +add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept {% if datacenter == 'rdu3' %} # Greg: This is a nasty hack and we need to fix it properly after the DC move, but right # now I don't see where we'd get the right ip/netmask from in vars -add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept {% else %} -add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 25 counter accept {% endif %} # s390x builders/virthost -add rule ip filter INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept # redhat mxes -add rule ip filter INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept # mimecast ips from # https://community.mimecast.com/s/article/email-security-cloud-gateway-data-centers-and-urls?r=297&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 -add rule ip filter INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_block_rules' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_proxy_ports' %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_end' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% set _nft_prio_preroute = "-100" %} +{% set _nft_prio_input = "100" %} +{% set _nft_prio_output = "-100" %} +{% set _nft_prio_postroute = "100" %} -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index d667b257b2..e70543f2fc 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -1,28 +1,9 @@ # {{ ansible_managed }} -# Setup an ip filter table with default drop policy. +# {{ template_path }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy drop; } +{% include '_nft_drop_beg' %} -# Std. allow rules for the drop policy - -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept -add rule ip filter OUTPUT oifname "lo" counter accept -add rule ip filter INPUT iifname "virbr0" counter accept -add rule ip filter OUTPUT oifname "virbr0" counter accept -add rule ip filter INPUT ip daddr 127.0.0.0/8 counter accept -add rule ip filter OUTPUT ip daddr 127.0.0.0/8 counter accept - -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept -add rule ip filter OUTPUT ip protocol icmp counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_drop_std' %} {% include '_nft_blocked_ips' %} @@ -31,9 +12,9 @@ add rule ip filter OUTPUT ct state related,established counter accept #!# WARNING: This is very different... # -A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT -add set ip filter osbuildapi { type ipv4_addr ; size 65536; } +add set {{_tn}} osbuildapi { type ipv4_addr ; size 65536; } -add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept +add rule {{_tn}} OUTPUT tcp dport 443 ip daddr @osbuildapi accept # Then in the update script... # nft flush set global osbuildapi @@ -46,57 +27,57 @@ add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept # kojipkgs {% if host in groups['buildvm_s390x'] %} -add rule ip filter OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept {% endif %} # tang for buildhw -add rule ip filter OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept # DNS -add rule ip filter OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept # bastion smtp -add rule ip filter OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept # infra.fp.o -add rule ip filter OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept # rsyslog out to log01 -add rule ip filter OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept # SSH -add rule ip filter INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept # add rdu3 ansible control host for now -add rule ip filter INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept # End of RDU3 {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %} # Allow SSHFS binding to koji01 -add rule ip filter OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept {% endif %} {% if inventory_hostname in groups['secureboot'] %} # Allow secure boot signing to contact the sign bridge -add rule ip filter OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.120 tcp dport 44334 counter accept {% endif %} # http to pull sources from pkgs lookaside -#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept +#add rule {{_tn}} OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept # https git on pagure,io -add rule ip filter OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept # IP Helper: # 10.3. = .iad2. @@ -124,89 +105,89 @@ add rule ip filter OUTPUT ip daddr 38.145.32.40 tcp dport 443 counter accept # admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10) {% if host in groups['staging'] %} -add rule ip filter OUTPUT ip daddr 10.16.166.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.75 tcp dport 443 counter accept {% endif %} -add rule ip filter OUTPUT ip daddr 10.16.163.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.75 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.76 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.76 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.77 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.77 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.76 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.76 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.77 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.77 tcp dport 443 counter accept {% if host in groups['rdu3_staging'] %} # ipa client ports -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept # rdu3 -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.21 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.166.63 udp dport 53 counter accept {% elif host in groups['rdu3_production'] %} # rdu3 ports -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.54 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.55 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.54 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.55 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept {% endif %} {% if host in groups['staging'] %} @@ -214,44 +195,33 @@ add rule ip filter OUTPUT ip daddr 10.16.163.104 udp dport 53 counter accept # **** # NOTE: There is NO koji01.stg.rdu3.fedoraproject.org YET # **** -add rule ip filter INPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept -add rule ip filter OUTPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept +add rule {{_tn}} INPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.167.64 tcp dport 2049 counter accept {% endif %} # NFS for rdu3 # a little to wide-open - but kinda necessary -add rule ip filter INPUT ip saddr 10.16.162.11 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.11 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.11 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.11 counter accept #!# NOTE: tcp/udp doesn't translate without a port?? -add rule ip filter INPUT ip saddr 10.16.162.12 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.12 counter accept -add rule ip filter INPUT ip saddr 10.16.162.13 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.13 counter accept -add rule ip filter INPUT ip saddr 10.16.162.14 counter accept -add rule ip filter OUTPUT ip daddr 10.16.162.14 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.12 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.12 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.13 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.13 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.14 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.162.14 counter accept # ntp -add rule ip filter OUTPUT ip daddr 10.16.163.31 udp dport 123 counter accept -add rule ip filter OUTPUT ip daddr 10.16.163.32 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.32 udp dport 123 counter accept # dhcp -add rule ip filter OUTPUT ip daddr 10.16.163.10 udp dport 67 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.10 udp dport 67 counter accept # s390x builders ssh -add rule ip filter INPUT ip saddr 10.16.0.0/16 tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.0.0/16 tcp dport 22 counter accept -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} - -# if there are custom rules - put them in as-is -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} +{% include '_nft_custom_rules' %} diff --git a/roles/base/templates/nftables/nftables.osuosl b/roles/base/templates/nftables/nftables.osuosl index ac87505328..5596703e65 100644 --- a/roles/base/templates/nftables/nftables.osuosl +++ b/roles/base/templates/nftables/nftables.osuosl @@ -1,63 +1,22 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_blocked_ips' %} # allow ssh only from needed ips # vpn in from tun0 -add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept +add rule {{_tn}} INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp dport 22 counter accept # external ip for rdu3 -add rule ip filter INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 38.145.32.0/24 ct state new tcp dport 22 counter accept -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept +{% include '_nft_accept_monitoring' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.releng b/roles/base/templates/nftables/nftables.releng index 725931529a..e4b2aaa620 100644 --- a/roles/base/templates/nftables/nftables.releng +++ b/roles/base/templates/nftables/nftables.releng @@ -1,92 +1,50 @@ # {{ ansible_managed }} +# {{ template_path }} + # # NOTE: Chaging this template updates iptables on all releng hosts :) # Please check with sysadmin-main before pushing out an update here. # -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +# NOTE: We don't use _nft_accept_beg because INPUT policy default is drop -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } -# Overwrite any global rules -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# add rdu3 ips -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept -# Zabbix -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_std' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} + +{% include '_nft_blocked_ips' %} # SSH #!# NOTE: Do we still need/wants these 13+ years later? # ssh block against uni in .cz where problem(s) have been cited # added by skvidal on jan 24 2011 - as per request from spot -add rule ip filter INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject +add rule {{_tn}} INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject # matches last rule for a service we want blocked -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset -add rule ip filter INPUT tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset +add rule {{_tn}} INPUT tcp dport 22 counter accept # Allow all netapp traffic -add rule ip filter INPUT ip saddr 10.16.162.0/24 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.162.0/24 counter accept +{% include '_nft_accept_ssh' %} -# Custom Services +{% include '_nft_accept_http' %} -# Services TCP -add rule ip filter INPUT tcp dport 22 counter accept -add rule ip filter INPUT tcp dport 80 counter accept -add rule ip filter INPUT tcp dport 443 counter accept +{% include '_nft_accept_ports' %} -# Services UDP +{% include '_nft_custom_rules' %} -# more services we use - ports for random services and TG listeners. -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_vpn' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# Extra protection for 192.168.100.x vpn hosts. -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited - -add rule ip filter INPUT counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.sign b/roles/base/templates/nftables/nftables.sign index cb26a74942..e551e2f20f 100644 --- a/roles/base/templates/nftables/nftables.sign +++ b/roles/base/templates/nftables/nftables.sign @@ -1,22 +1,11 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_beg' %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +{% include '_nft_accept_std' %} # Allow connections from client/server -add rule ip filter INPUT tcp dport 44333-44334 counter accept - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT tcp dport 44333-44334 counter accept +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.staging b/roles/base/templates/nftables/nftables.staging index b6c20eb0e5..3086c7097f 100644 --- a/roles/base/templates/nftables/nftables.staging +++ b/roles/base/templates/nftables/nftables.staging @@ -1,53 +1,20 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_monitoring' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -# zabbix01.stg -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept +{% include '_nft_block_rules' %} -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} - -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} +# NOTE: This uses proxies_stg and not proxies. Also the VPN bits. ... so unique +# version of '_nft_accept_proxy_ports' # if there are any proxy-only tcp_ports - allow them {% if proxy_tcp_ports is defined %} @@ -55,24 +22,17 @@ add rule ip filter INPUT udp dport {{ port }} counter accept {% for proxy in groups['proxies_stg'] %} {% if hostvars[proxy]['vpn'] %} #!# FIXME: This test is the negation of the one in iptables. -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept {% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept {% endif %} {% endfor %} # No nagios {% endfor %} {% endif %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} # No nat rules diff --git a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org index fbb967c7f2..7c0df8cf75 100644 --- a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org +++ b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org @@ -1,42 +1,23 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_blocked_ips' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -# NOTE: we don't allow 10.16.163.10 / 10.16.166.10 or zabbix? +# NOTE: This is _nft_accept_ports but with special variables. # if the host/group defines incoming tcp_ports - allow them # NOTE: These are specific to eth0 {% if tcp_ports_eth0 is defined %} {% for port in tcp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -44,7 +25,7 @@ add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept # NOTE: These are specific to eth0 {% if udp_ports_eth0 is defined %} {% for port in udp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -52,7 +33,7 @@ add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if tcp_ports_eth1 is defined %} {% for port in tcp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -60,30 +41,19 @@ add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if udp_ports_eth1 is defined %} {% for port in udp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" udp dport {{ port }} counter accept {% endfor %} {% endif %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_custom_rules' %} -{% if nft_nat_rules %} -#!# FIXME: These are different priority to iptables template... -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority 0; policy accept; } -add chain ip nat INPUT { type nat hook input priority 0; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority 0; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; } +{% include '_nft_accept_end' %} -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +# Why are these different from nftables?? +{% set _nft_prio_preroute = "0" %} +{% set _nft_prio_input = "0" %} +{% set _nft_prio_output = "0" %} +{% set _nft_prio_postroute = "0" %} + +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org index d384153524..17ab8a187b 100644 --- a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org +++ b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org @@ -1,87 +1,31 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_blocked_ips' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -# NOTE: This doesn't include 10.16.166.10 -# NOTE: This doesn't include zabbix. +{% include '_nft_accept_ports' %} -{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the phx2 datacenter, both production and staging hosts are in the same -# subnet/vlan. We want production hosts to reject connectons from staging group hosts -# to prevent them from interfering with production. There are however a few hosts in -# production we have marked 'staging-friendly' that we do allow staging to talk to for -# mostly read-only data they need. -# -{% for host in groups['staging']|sort %} -{% if 'eth0_ip' in hostvars[host] %}# {{ host }} -add rule ip filter INPUT ip saddr {{ hostvars[host]['eth0_ip'] }} counter reject with icmp type host-prohibited -{% else %}# {{ host }} has no 'eth0_ip' listed -{% endif %} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} +{% include '_nft_accept_end' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +# This is the special bit for torrents... +{% set _tnr = nft_table_raw %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -add table ip raw -add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; } -add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; } +add table {{_tnr}} +add chain {{_tnr}} PREROUTING { type filter hook prerouting priority -300; policy accept; } +add chain {{_tnr}} OUTPUT { type filter hook output priority -300; policy accept; } # # We don't want to track all the torrent tracker connections, there's too many. # -add rule ip raw PREROUTING tcp dport 6969 counter notrack -add rule ip raw OUTPUT tcp sport 6969 counter notrack +add rule {{_tnr}} PREROUTING tcp dport 6969 counter notrack +add rule {{_tnr}} OUTPUT tcp sport 6969 counter notrack diff --git a/roles/koji_builder/templates/osbuildapi-update-nft.sh b/roles/koji_builder/templates/osbuildapi-update-nft.sh index 7c729551ad..79fce3aa3a 100644 --- a/roles/koji_builder/templates/osbuildapi-update-nft.sh +++ b/roles/koji_builder/templates/osbuildapi-update-nft.sh @@ -14,16 +14,16 @@ # 2. Checking if it exists and failing with a "nice" message, if it doesn't. # 3. Waiting for it to exist. -# if ! nft list set ip filter osbuildapi >& /dev/null; then +# if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then # exit 0 # fi -if ! nft list set ip filter osbuildapi >& /dev/null; then - echo "OSBUILD: nft set ip filter osbuildapi: Doesn't exist" 1>&2; +if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then + echo "OSBUILD: nft set {{nft_table_filter}} osbuildapi: Doesn't exist" 1>&2; exit 2 fi -while ! nft list set ip filter osbuildapi >& /dev/null; do +while ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; do sleep 10 done @@ -47,15 +47,15 @@ NEWIDENTITYIPS=`echo "$RESOLVEQUERY" | grep link | sed -E 's/.* ([0-9]+\.[0-9]+\ # Empty the filter: We do this at the end for a small window.` # NOTE: We aren't flushing old entries anymore. # See commit: e7b50aaee469fdded0ea650c7e7f4dd06e929609 -# nft flush set ip filter osbuildapi +# nft flush set {{nft_table_filter}} osbuildapi # Add the IPs... for j in $NEWIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done for j in $NEWIDENTITYIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done diff --git a/scripts/maint-update-reboot.sh b/scripts/maint-update-reboot.sh index 1fc34fbbd5..bc17444a16 100755 --- a/scripts/maint-update-reboot.sh +++ b/scripts/maint-update-reboot.sh @@ -8,7 +8,7 @@ ssh "$host" dnf --refresh -y up if [ "$(ssh $host who | wc -l)" = "1" ]; then ansible -m reboot "$host" - ssh "$host" rkhunter --propupd + ssh "$host" rkhunter --propupd || true else echo " ** Skipping reboot as Users on: $host" fi