From ae9230c37f13f0d8cfe9447d269dd39ba3780aec Mon Sep 17 00:00:00 2001 From: James Antill Date: Thu, 16 Apr 2026 01:15:50 -0400 Subject: [PATCH 1/2] Cleanup the nftables files, using includes. Rename the tables to be cle_ prefixed/unique. This allows people to run cle nftables and firewalld etc. Signed-off-by: James Antill --- inventory/group_vars/all | 6 + roles/base/templates/nftables/_nft_accept_beg | 14 ++ roles/base/templates/nftables/_nft_accept_end | 7 + .../base/templates/nftables/_nft_accept_http | 6 + .../templates/nftables/_nft_accept_monitoring | 15 ++ .../base/templates/nftables/_nft_accept_ports | 16 ++ .../nftables/_nft_accept_proxy_ports | 17 ++ roles/base/templates/nftables/_nft_accept_ssh | 6 + roles/base/templates/nftables/_nft_accept_std | 12 + roles/base/templates/nftables/_nft_accept_vpn | 24 ++ .../base/templates/nftables/_nft_block_rules | 9 + .../base/templates/nftables/_nft_blocked_ips | 9 + .../base/templates/nftables/_nft_custom_rules | 9 + roles/base/templates/nftables/_nft_drop_beg | 17 ++ roles/base/templates/nftables/_nft_drop_std | 12 + roles/base/templates/nftables/_nft_nat | 15 ++ roles/base/templates/nftables/nftables | 130 ++-------- roles/base/templates/nftables/nftables-ipv6 | 39 +-- .../base/templates/nftables/nftables.bastion | 170 +++---------- .../templates/nftables/nftables.kojibuilder | 233 ++++++++---------- roles/base/templates/nftables/nftables.osuosl | 55 +---- roles/base/templates/nftables/nftables.releng | 89 ++----- roles/base/templates/nftables/nftables.sign | 21 +- .../base/templates/nftables/nftables.staging | 52 +--- ...nftables.storinator01.fedorainfracloud.org | 70 ++---- .../nftables.torrent02.fedoraproject.org | 88 ++----- 26 files changed, 451 insertions(+), 690 deletions(-) create mode 100644 roles/base/templates/nftables/_nft_accept_beg create mode 100644 roles/base/templates/nftables/_nft_accept_end create mode 100644 roles/base/templates/nftables/_nft_accept_http create mode 100644 roles/base/templates/nftables/_nft_accept_monitoring create mode 100644 roles/base/templates/nftables/_nft_accept_ports create mode 100644 roles/base/templates/nftables/_nft_accept_proxy_ports create mode 100644 roles/base/templates/nftables/_nft_accept_ssh create mode 100644 roles/base/templates/nftables/_nft_accept_std create mode 100644 roles/base/templates/nftables/_nft_accept_vpn create mode 100644 roles/base/templates/nftables/_nft_block_rules create mode 100644 roles/base/templates/nftables/_nft_blocked_ips create mode 100644 roles/base/templates/nftables/_nft_custom_rules create mode 100644 roles/base/templates/nftables/_nft_drop_beg create mode 100644 roles/base/templates/nftables/_nft_drop_std create mode 100644 roles/base/templates/nftables/_nft_nat diff --git a/inventory/group_vars/all b/inventory/group_vars/all index 90e9a4b647..229e9f8e64 100644 --- a/inventory/group_vars/all +++ b/inventory/group_vars/all @@ -155,6 +155,12 @@ nftables: True nft_custom6_rules: [] nft_custom_rules: [] nft_nat_rules: [] +# Table names for nft +# Note that the ip/ip6 prefix here means we only look at IPv4/IPv6 packets. +nft_table_filter: "ip cle_infra_filter" +nft_table_nat: "ip cle_infra_nat" +nft_table_raw: "ip cle_infra_raw" +nft_table6_filter: "ip6 cle_infra_filter" # default network block device encryption settings for linux-system-roles/nbde_client nbde: true nbde_device: /dev/md2 diff --git a/roles/base/templates/nftables/_nft_accept_beg b/roles/base/templates/nftables/_nft_accept_beg new file mode 100644 index 0000000000..aa5c8f2236 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_beg @@ -0,0 +1,14 @@ +# {{ ansible_managed }} +# _nft_accept_beg +# Setup an ip filter table with default accept policy, and the std. allow rules. + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } diff --git a/roles/base/templates/nftables/_nft_accept_end b/roles/base/templates/nftables/_nft_accept_end new file mode 100644 index 0000000000..da906e3462 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_end @@ -0,0 +1,7 @@ +# _nft_accept_end +# Default accept policy, standard end rules +# This kind of makes it default drop, but the spelling is weird. + +# otherwise kick everything out +add rule {{_tn}} INPUT counter reject with icmp type host-prohibited +add rule {{_tn}} FORWARD counter reject with icmp type host-prohibited diff --git a/roles/base/templates/nftables/_nft_accept_http b/roles/base/templates/nftables/_nft_accept_http new file mode 100644 index 0000000000..564243a11c --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_http @@ -0,0 +1,6 @@ +# _nft_accept_http +# Accept HTTP(s) + +add rule {{_tn}} INPUT ct state new tcp dport 80 counter accept +add rule {{_tn}} INPUT ct state new tcp dport 443 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring new file mode 100644 index 0000000000..2f61227b25 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -0,0 +1,15 @@ +# _nft_accept_monitoring +# Default accept policy, let things be monitored + +# for nrpe - allow it from nocs +add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept +# FIXME - this is the global nat-ip and we need the noc01-specific ip +add rule {{_tn}} INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept +# zabbix01 +add rule {{_tn}} INPUT tcp dport 10051 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_ports b/roles/base/templates/nftables/_nft_accept_ports new file mode 100644 index 0000000000..0583fb9104 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ports @@ -0,0 +1,16 @@ +# _nft_accept_ports +# Default accept policy, accept host defined tcp/udp ports + +# if the host/group defines incoming tcp_ports - allow them +{% if tcp_ports is defined %} +{% for port in tcp_ports %} +add rule {{_tn}} INPUT tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} + +# if the host/group defines incoming udp_ports - allow them +{% if udp_ports is defined %} +{% for port in udp_ports %} +add rule {{_tn}} INPUT udp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_proxy_ports b/roles/base/templates/nftables/_nft_accept_proxy_ports new file mode 100644 index 0000000000..24f8c14037 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_proxy_ports @@ -0,0 +1,17 @@ +# _nft_accept_proxy_ports +# Default accept policy, deal with proxy ports (if defined) + +# if there are any proxy-only tcp_ports - allow them +{% if proxy_tcp_ports is defined %} +{% for port in proxy_tcp_ports %} +{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} +{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% else %} +add rule {{_tn}} INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept +{% endif %} +{% endfor %} +# nagios +add rule {{_tn}} INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_accept_ssh b/roles/base/templates/nftables/_nft_accept_ssh new file mode 100644 index 0000000000..24f0093058 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_ssh @@ -0,0 +1,6 @@ +# _nft_accept_ssh +# Accept ssh + +# allow ssh - always +add rule {{_tn}} INPUT ct state new tcp dport 22 counter accept + diff --git a/roles/base/templates/nftables/_nft_accept_std b/roles/base/templates/nftables/_nft_accept_std new file mode 100644 index 0000000000..493da9a8ae --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_std @@ -0,0 +1,12 @@ +# _nft_accept_std +# Standard accept lines, SSH is _not_ here. + +# allow ping and traceroute +add rule {{_tn}} INPUT ip protocol icmp counter accept + +# localhost is fine +add rule {{_tn}} INPUT iifname "lo" counter accept + +# Established connections allowed +add rule {{_tn}} INPUT ct state related,established counter accept +add rule {{_tn}} OUTPUT ct state related,established counter accept diff --git a/roles/base/templates/nftables/_nft_accept_vpn b/roles/base/templates/nftables/_nft_accept_vpn new file mode 100644 index 0000000000..826c9bbae6 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_vpn @@ -0,0 +1,24 @@ +# _nft_accept_vpn +# Default accept policy, vpn stuff. +# NOTE: That the end of this file rejects all other VPN traffic. + +{% if vpn %} +# +# We want to have all vpn hosts reject most things from the 'less secure' vpn network +# +{% if inventory_hostname in groups['ipa'] %} +# Allow all vpn hosts to talk to the ipa servers for auth +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept + +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept +{% endif %} + +# Reject all further connections from less secure vpn +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/_nft_block_rules b/roles/base/templates/nftables/_nft_block_rules new file mode 100644 index 0000000000..1e78f98ba3 --- /dev/null +++ b/roles/base/templates/nftables/_nft_block_rules @@ -0,0 +1,9 @@ +# _nft_block_rules +# Default accept policy, standard end rules + +{% if nft_block_rules is defined %} +# if there are block rules - put them in as-is +{% for rule in nft_block_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_blocked_ips b/roles/base/templates/nftables/_nft_blocked_ips new file mode 100644 index 0000000000..9f6b23d4fb --- /dev/null +++ b/roles/base/templates/nftables/_nft_blocked_ips @@ -0,0 +1,9 @@ +# _nft_blocked_ips +# Probably only use for: Default drop policy + +# if the blocked_ips is defined - drop them +{% if blocked_ips is defined %} +{% for ip in blocked_ips %} +add rule {{_tn}} INPUT ip saddr {{ ip }} counter drop +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_custom_rules b/roles/base/templates/nftables/_nft_custom_rules new file mode 100644 index 0000000000..bf63274c8a --- /dev/null +++ b/roles/base/templates/nftables/_nft_custom_rules @@ -0,0 +1,9 @@ +# _nft_custom_rules +# Probably only use for: Default accept policy + +# if there are custom rules - put them in as-is +{% if nft_custom_rules is defined %} +{% for rule in nft_custom_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/_nft_drop_beg b/roles/base/templates/nftables/_nft_drop_beg new file mode 100644 index 0000000000..3663d11ed4 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_beg @@ -0,0 +1,17 @@ +# {{ ansible_managed }} +# _nft_drop_beg +# Setup an ip filter table with default drop policy. +# +# Note that there's no _nft_drop_end because _nft_accept_end drops everything +# and we don't need that. + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} + +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy drop; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy drop; } diff --git a/roles/base/templates/nftables/_nft_drop_std b/roles/base/templates/nftables/_nft_drop_std new file mode 100644 index 0000000000..f0bbb6dee1 --- /dev/null +++ b/roles/base/templates/nftables/_nft_drop_std @@ -0,0 +1,12 @@ +# _nft_drop_std +# Std. allow rules for the drop policy + + +{% include '_nft_accept_std' %} + +# MORE loopback allowed +add rule {{_tn}} OUTPUT oifname "lo" counter accept +add rule {{_tn}} INPUT iifname "virbr0" counter accept +add rule {{_tn}} OUTPUT oifname "virbr0" counter accept +add rule {{_tn}} INPUT ip daddr 127.0.0.0/8 counter accept +add rule {{_tn}} OUTPUT ip daddr 127.0.0.0/8 counter accept diff --git a/roles/base/templates/nftables/_nft_nat b/roles/base/templates/nftables/_nft_nat new file mode 100644 index 0000000000..f185cb2a4e --- /dev/null +++ b/roles/base/templates/nftables/_nft_nat @@ -0,0 +1,15 @@ +# _nft_nat +# Setup forwarding via. "ip nat" table, if we have nat rules. + +{% if nft_nat_rules is defined %} + +add table {{_tnat}} +add chain {{_tnat}} PREROUTING { type nat hook prerouting priority {{_nft_prio_preroute}}; policy accept; } +add chain {{_tnat}} INPUT { type nat hook input priority {{_nft_prio_input}}; policy accept; } +add chain {{_tnat}} OUTPUT { type nat hook output priority {{_nft_prio_output}}; policy accept; } +add chain {{_tnat}} POSTROUTING { type nat hook postrouting priority {{_nft_prio_postroute}}; policy accept; } + +{% for rule in nft_nat_rules %} +{{ rule }} +{% endfor %} +{% endif %} diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index a8631a84d1..90806de03c 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -1,127 +1,29 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_monitoring' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_vpn' %} -{% if env != 'staging' and datacenter == 'iad2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the iad2 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.3.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.3.167.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_block_rules' %} -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.iad2.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept +{% include '_nft_accept_ports' %} -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_proxy_ports' %} +{% include '_nft_custom_rules' %} -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_end' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% set _nft_prio_preroute = "-100" %} +{% set _nft_prio_input = "100" %} +{% set _nft_prio_output = "-100" %} +{% set _nft_prio_postroute = "100" %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables-ipv6 b/roles/base/templates/nftables/nftables-ipv6 index c1fa235ccf..09dc65915e 100644 --- a/roles/base/templates/nftables/nftables-ipv6 +++ b/roles/base/templates/nftables/nftables-ipv6 @@ -1,48 +1,51 @@ # {{ ansible_managed }} -add table ip6 filter -add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; } + +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn6 = nft_table6_filter %} + +add table {{_tn6}} +add chain {{_tn6}} INPUT { type filter hook input priority 0; policy accept; } +add chain {{_tn6}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn6}} OUTPUT { type filter hook output priority 0; policy accept; } # loopback allowed -add rule ip6 filter INPUT iifname "lo" counter accept +add rule {{_tn6}} INPUT iifname "lo" counter accept # Accept ping and traceroute (needs icmp) -add rule ip6 filter INPUT meta l4proto ipv6-icmp counter accept +add rule {{_tn6}} INPUT meta l4proto ipv6-icmp counter accept # Established connections allowed -add rule ip6 filter INPUT ct state related,established counter accept +add rule {{_tn6}} INPUT ct state related,established counter accept # Established connections allowed -add rule ip6 filter OUTPUT ct state related,established counter accept +add rule {{_tn6}} OUTPUT ct state related,established counter accept # allow dhcp6d from aws -add rule ip6 filter INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept +add rule {{_tn6}} INPUT ip6 daddr fe80::/64 udp sport 547 udp dport 546 counter accept # if the blocked_ips is defined - drop them {% if blocked_ip_v6 is defined %} {% for ip in blocked_ip_v6 %} -add rule ip6 filter INPUT ip6 saddr {{ ip }} counter drop +add rule {{_tn6}} INPUT ip6 saddr {{ ip }} counter drop {% endfor %} {% endif %} # allow ssh - always -add rule ip6 filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe (if we want noc02 to be able to get into remote systems) -#add rule ip6 filter INPUT ip6 saddr 2600:2701:4000:5211:dead:beef:fe:fed9 tcp dport 5666 counter accept +add rule {{_tn6}} INPUT ct state new tcp dport 22 counter accept # if the host/group defines incoming tcp_ports - allow them {% if tcp_ports is defined %} {% for port in tcp_ports %} -add rule ip6 filter INPUT tcp dport {{ port }} counter accept +add rule {{_tn6}} INPUT tcp dport {{ port }} counter accept {% endfor %} {% endif %} # if the host/group defines incoming udp_ports - allow them {% if udp_ports is defined %} {% for port in udp_ports %} -add rule ip6 filter INPUT udp dport {{ port }} counter accept +add rule {{_tn6}} INPUT udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -54,5 +57,5 @@ add rule ip6 filter INPUT udp dport {{ port }} counter accept {% endif %} # otherwise kick everything out -add rule ip6 filter INPUT counter reject with icmpv6 type admin-prohibited -add rule ip6 filter FORWARD counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} INPUT counter reject with icmpv6 type admin-prohibited +add rule {{_tn6}} FORWARD counter reject with icmpv6 type admin-prohibited diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index bbdc4878df..4eb3cfd6fa 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -1,155 +1,53 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept - -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept -# zabbix01 -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept - -{% if env != 'staging' and datacenter == 'iad2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the iad2 datacenter, both production and staging hosts are in different -# vlans, and different subnets. However, just as a precaution, we want prod machines to -# reject connections from any staging host just in case there's some globally enabled port. -# There are however a few hosts in production we have marked 'staging-friendly' -# that we do allow staging to talk to for mostly read-only data they need. -# -add rule ip filter INPUT ip saddr 10.3.166.0/24 counter reject with icmp type host-prohibited -add rule ip filter INPUT ip saddr 10.3.167.0/24 counter reject with icmp type host-prohibited -{% endif %} - -{% if vpn %} -# -# We want to have all vpn hosts reject most things from the 'less secure' vpn network -# -{% if inventory_hostname == 'log01.iad2.fedoraproject.org' %} -# Allow all vpn hosts to talk to the log server for rsyslog -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 514 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 25826 counter accept -{% endif %} -{% if inventory_hostname in groups['ipa'] %} -# Allow all vpn hosts to talk to the ipa servers for auth -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 80 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 389 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 443 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 464 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 636 counter accept - -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 88 counter accept -add rule ip filter INPUT ip saddr 192.168.100.0/24 udp dport 464 counter accept -{% endif %} -# Reject all further connections from less secure vpn -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited -{% endif %} +{% include '_nft_accept_monitoring' %} # smtp rules we want to allow vpn and out internal networks and mimecast -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.1.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept +# This rejects all VPN traffic at the end. +{% include '_nft_accept_vpn' %} + +add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept # s390x builders/virthost -add rule ip filter INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.1.102.0/24 tcp dport 25 counter accept # redhat mxes -add rule ip filter INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.177.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 10.30.29.0/24 tcp dport 25 counter accept # mimecast ips from # https://community.mimecast.com/s/article/email-security-cloud-gateway-data-centers-and-urls?r=297&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 -add rule ip filter INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept -add rule ip filter INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.128.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.129.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.130.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.131.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.132.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 170.10.133.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.31.0/25 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.110.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 205.139.111.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 216.205.24.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 63.128.21.0/24 tcp dport 25 counter accept +add rule {{_tn}} INPUT ip saddr 207.211.30.40/26 tcp dport 25 counter accept -{% if nft_block_rules is defined %} -# if there are block rules - put them in as-is -{% for rule in nft_block_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_block_rules' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_proxy_ports' %} -# if there are any proxy-only tcp_ports - allow them -{% if proxy_tcp_ports is defined %} -{% for port in proxy_tcp_ports %} -{% for proxy in (groups['proxies'] + groups['proxies_internal']) %} -{% if hostvars[proxy]['datacenter'] == "phx2" and 'ansible_eth0' in hostvars[proxy] %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% else %} -add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_tun0']['ipv4']['address'] }} tcp dport {{ port }} counter accept -{% endif %} -{% endfor %} -# nagios -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_accept_end' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -{% if nft_nat_rules is defined %} - -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority -100; policy accept; } -add chain ip nat INPUT { type nat hook input priority 100; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority -100; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 100; policy accept; } - -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index dbdbfd1412..3b4c0ea2a0 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -1,40 +1,20 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy drop; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy drop; } +# {{ template_path }} -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept -add rule ip filter OUTPUT oifname "lo" counter accept -add rule ip filter INPUT iifname "virbr0" counter accept -add rule ip filter OUTPUT oifname "virbr0" counter accept -add rule ip filter INPUT ip daddr 127.0.0.0/8 counter accept -add rule ip filter OUTPUT ip daddr 127.0.0.0/8 counter accept +{% include '_nft_drop_beg' %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept -add rule ip filter OUTPUT ip protocol icmp counter accept +{% include '_nft_drop_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_blocked_ips' %} {% if host in groups['osbuild'] %} # osbuild api for osbuild koji plugin #!# WARNING: This is very different... # -A OUTPUT -p tcp --dport 443 -m set --match-set osbuildapi dst -j ACCEPT -add set ip filter osbuildapi { type ipv4_addr ; size 65536; } +add set {{_tn}} osbuildapi { type ipv4_addr ; size 65536; } -add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept +add rule {{_tn}} OUTPUT tcp dport 443 ip daddr @osbuildapi accept # Then in the update script... # nft flush set global osbuildapi @@ -47,155 +27,144 @@ add rule ip filter OUTPUT tcp dport 443 ip daddr @osbuildapi accept # kojipkgs {% if host in groups['buildvm_s390x'] %} -add rule ip filter OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept {% endif %} # tang for buildhw -add rule ip filter OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept # DNS -add rule ip filter OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept # bastion smtp -add rule ip filter OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept # infra.fp.o -add rule ip filter OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept # rsyslog out to log01 -add rule ip filter OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept # SSH -add rule ip filter INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %} # Allow SSHFS binding to koji01 -add rule ip filter OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept {% endif %} # http to pull sources from pkgs lookaside -#add rule ip filter OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept +#add rule {{_tn}} OUTPUT ip daddr 10.5.125.44 tcp dport 80 counter accept # https git on pagure,io -add rule ip filter OUTPUT ip daddr 8.43.85.76 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 8.43.85.76 tcp dport 443 counter accept # admin.fedoraproject.org for fas (proyx(1)01 and proxy(1)10) {% if host in groups['staging'] %} -add rule ip filter OUTPUT ip daddr 10.3.166.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.75 tcp dport 443 counter accept {% endif %} -add rule ip filter OUTPUT ip daddr 10.3.163.74 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.74 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.75 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.75 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.76 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.76 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.77 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.77 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.74 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.74 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.75 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.75 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.76 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.76 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.77 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.77 tcp dport 443 counter accept # ipa client ports {% if host in groups['staging'] %} -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.21 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.166.63 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.21 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.166.63 udp dport 53 counter accept {% else %} -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 80 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 443 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 389 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 636 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 88 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 tcp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 464 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.54 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.55 udp dport 53 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.104 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 389 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 636 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 88 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 tcp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 464 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.54 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.55 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.104 udp dport 53 counter accept {% endif %} {% if host in groups['staging'] %} # Allow nfs from koji01 -add rule ip filter INPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept -add rule ip filter OUTPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept +add rule {{_tn}} INPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.167.64 tcp dport 2049 counter accept {% endif %} #nfs to vtap-fedora-nfs01.storage.phx2.redhat.com - a little to wide-open - but # kinda necessary -add rule ip filter INPUT ip saddr 10.3.162.11 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.11 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.11 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.11 counter accept #!# NOTE: tcp/udp doesn't translate without a port?? -add rule ip filter INPUT ip saddr 10.3.162.12 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.12 counter accept -add rule ip filter INPUT ip saddr 10.3.162.13 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.13 counter accept -add rule ip filter INPUT ip saddr 10.3.162.14 counter accept -add rule ip filter OUTPUT ip daddr 10.3.162.14 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.12 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.12 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.13 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.13 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.14 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.162.14 counter accept # ntp -add rule ip filter OUTPUT ip daddr 10.3.163.31 udp dport 123 counter accept -add rule ip filter OUTPUT ip daddr 10.3.163.32 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 udp dport 123 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.32 udp dport 123 counter accept # dhcp -add rule ip filter OUTPUT ip daddr 10.3.163.10 udp dport 67 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.163.10 udp dport 67 counter accept # s390x builders ssh -add rule ip filter INPUT ip saddr 10.3.0.0/16 tcp dport 22 counter accept -add rule ip filter OUTPUT ip daddr 10.3.0.0/16 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.0.0/16 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.3.0.0/16 tcp sport 22 counter accept -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} - -# if there are custom rules - put them in as-is -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} +{% include '_nft_custom_rules' %} diff --git a/roles/base/templates/nftables/nftables.osuosl b/roles/base/templates/nftables/nftables.osuosl index e3ab7b4cfc..9c375f38d0 100644 --- a/roles/base/templates/nftables/nftables.osuosl +++ b/roles/base/templates/nftables/nftables.osuosl @@ -1,25 +1,11 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept - -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_blocked_ips' %} # allow ssh only from needed ips # vpn in from tun0 @@ -27,35 +13,10 @@ add rule ip filter INPUT iifname "tun0" ip saddr 192.168.0.0/24 ct state new tcp # external ip for iad2 add rule ip filter INPUT ip saddr 38.145.60.0/24 ct state new tcp dport 22 counter accept -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept +{% include '_nft_accept_monitoring' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_ports' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.releng b/roles/base/templates/nftables/nftables.releng index 5ca033a2e2..eac603212a 100644 --- a/roles/base/templates/nftables/nftables.releng +++ b/roles/base/templates/nftables/nftables.releng @@ -1,87 +1,50 @@ # {{ ansible_managed }} +# {{ template_path }} + # # NOTE: Chaging this template updates iptables on all releng hosts :) # Please check with sysadmin-main before pushing out an update here. # -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy drop; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +# NOTE: We don't use _nft_accept_beg because INPUT policy default is drop -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept +# Set small Table Names. +# We need the big global ones so we can use them in *_rules but, that would be +# a lot in these files. +{% set _tn = nft_table_filter %} +{% set _tnat = nft_table_nat %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +add table {{_tn}} +add chain {{_tn}} INPUT { type filter hook input priority 0; policy drop; } +add chain {{_tn}} FORWARD { type filter hook forward priority 0; policy accept; } +add chain {{_tn}} OUTPUT { type filter hook output priority 0; policy accept; } -# Overwrite any global rules -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.166.10 tcp dport 5666 counter accept -# Zabbix -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept +{% include '_nft_accept_std' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} + +{% include '_nft_blocked_ips' %} # SSH #!# NOTE: Do we still need/wants these 13+ years later? # ssh block against uni in .cz where problem(s) have been cited # added by skvidal on jan 24 2011 - as per request from spot -add rule ip filter INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject +add rule {{_tn}} INPUT ip saddr 147.251.0.0/16 tcp dport 22 counter reject # matches last rule for a service we want blocked -add rule ip filter INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset -add rule ip filter INPUT tcp dport 22 counter accept +add rule {{_tn}} INPUT ip saddr 192.168.100.0/24 tcp dport 22 counter reject with tcp reset +add rule {{_tn}} INPUT tcp dport 22 counter accept # Allow all netapp traffic -add rule ip filter INPUT ip saddr 10.3.162.0/24 counter accept +add rule {{_tn}} INPUT ip saddr 10.3.162.0/24 counter accept +{% include '_nft_accept_ssh' %} -# Custom Services +{% include '_nft_accept_http' %} -# Services TCP -add rule ip filter INPUT tcp dport 22 counter accept -add rule ip filter INPUT tcp dport 80 counter accept -add rule ip filter INPUT tcp dport 443 counter accept +{% include '_nft_accept_ports' %} -# Services UDP +{% include '_nft_custom_rules' %} -# more services we use - ports for random services and TG listeners. -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +{% include '_nft_accept_vpn' %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# Extra protection for 192.168.100.x vpn hosts. -add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited - -add rule ip filter INPUT counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.sign b/roles/base/templates/nftables/nftables.sign index cb26a74942..e551e2f20f 100644 --- a/roles/base/templates/nftables/nftables.sign +++ b/roles/base/templates/nftables/nftables.sign @@ -1,22 +1,11 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# loopback allowed -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_beg' %} -# Accept ping and traceroute (needs icmp) -add rule ip filter INPUT ip protocol icmp counter accept - -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept +{% include '_nft_accept_std' %} # Allow connections from client/server -add rule ip filter INPUT tcp dport 44333-44334 counter accept - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT tcp dport 44333-44334 counter accept +{% include '_nft_accept_end' %} diff --git a/roles/base/templates/nftables/nftables.staging b/roles/base/templates/nftables/nftables.staging index 3d13e3e928..564f9a8e09 100644 --- a/roles/base/templates/nftables/nftables.staging +++ b/roles/base/templates/nftables/nftables.staging @@ -1,43 +1,18 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_accept_monitoring' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -# zabbix01.stg -add rule ip filter INPUT tcp dport 10051 counter accept -add rule ip filter INPUT ip saddr 10.3.166.61 tcp dport 10050 counter accept +{% include '_nft_accept_ports' %} - -# if the host/group defines incoming tcp_ports - allow them -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} - -# if the host/group defines incoming udp_ports - allow them -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} +# NOTE: This uses proxies_stg and not proxies. Also the VPN bits. ... so unique +# include '_nft_accept_proxy_ports' # if there are any proxy-only tcp_ports - allow them {% if proxy_tcp_ports is defined %} @@ -54,15 +29,8 @@ add rule ip filter INPUT ip saddr {{ hostvars[proxy]['ansible_eth0']['ipv4']['ad {% endfor %} {% endif %} -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} # No nat rules diff --git a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org index 4e1885a941..bd8e00f81d 100644 --- a/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org +++ b/roles/base/templates/nftables/nftables.storinator01.fedorainfracloud.org @@ -1,42 +1,23 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_blocked_ips' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -# NOTE: we don't allow 10.3.163.10 / 10.3.166.10 or zabbix? +# NOTE: This is _nft_accept_ports but with special variables. # if the host/group defines incoming tcp_ports - allow them # NOTE: These are specific to eth0 {% if tcp_ports_eth0 is defined %} {% for port in tcp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -44,7 +25,7 @@ add rule ip filter INPUT iifname "eth0" tcp dport {{ port }} counter accept # NOTE: These are specific to eth0 {% if udp_ports_eth0 is defined %} {% for port in udp_ports_eth0 %} -add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth0" udp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -52,7 +33,7 @@ add rule ip filter INPUT iifname "eth0" udp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if tcp_ports_eth1 is defined %} {% for port in tcp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" tcp dport {{ port }} counter accept {% endfor %} {% endif %} @@ -60,30 +41,19 @@ add rule ip filter INPUT iifname "eth1" tcp dport {{ port }} counter accept # NOTE: These are specific to eth1 {% if udp_ports_eth1 is defined %} {% for port in udp_ports_eth1 %} -add rule ip filter INPUT iifname "eth1" udp dport {{ port }} counter accept +add rule {{_tn}} INPUT iifname "eth1" udp dport {{ port }} counter accept {% endfor %} {% endif %} +a -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited +{% include '_nft_accept_end' %} -{% if nft_nat_rules %} -#!# FIXME: These are different priority to iptables template... -add table ip nat -add chain ip nat PREROUTING { type nat hook prerouting priority 0; policy accept; } -add chain ip nat INPUT { type nat hook input priority 0; policy accept; } -add chain ip nat OUTPUT { type nat hook output priority 0; policy accept; } -add chain ip nat POSTROUTING { type nat hook postrouting priority 0; policy accept; } +# Why are these different from nftables?? +{% set _nft_prio_preroute = "0" %} +{% set _nft_prio_input = "0" %} +{% set _nft_prio_output = "0" %} +{% set _nft_prio_postroute = "0" %} -{% for rule in nft_nat_rules %} -{{ rule }} -{% endfor %} -{% endif %} +{% include '_nft_nat' %} diff --git a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org index 21f105432f..17ab8a187b 100644 --- a/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org +++ b/roles/base/templates/nftables/nftables.torrent02.fedoraproject.org @@ -1,87 +1,31 @@ # {{ ansible_managed }} -add table ip filter -add chain ip filter INPUT { type filter hook input priority 0; policy accept; } -add chain ip filter FORWARD { type filter hook forward priority 0; policy accept; } -add chain ip filter OUTPUT { type filter hook output priority 0; policy accept; } +# {{ template_path }} -# allow ping and traceroute -add rule ip filter INPUT ip protocol icmp counter accept +{% include '_nft_accept_beg' %} -# localhost is fine -add rule ip filter INPUT iifname "lo" counter accept +{% include '_nft_accept_std' %} -# Established connections allowed -add rule ip filter INPUT ct state related,established counter accept -add rule ip filter OUTPUT ct state related,established counter accept +{% include '_nft_accept_ssh' %} -# if the blocked_ips is defined - drop them -{% if blocked_ips is defined %} -{% for ip in blocked_ips %} -add rule ip filter INPUT ip saddr {{ ip }} counter drop -{% endfor %} -{% endif %} +{% include '_nft_accept_monitoring' %} -# allow ssh - always -add rule ip filter INPUT ct state new tcp dport 22 counter accept +{% include '_nft_blocked_ips' %} -# for nrpe - allow it from nocs -add rule ip filter INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept -# FIXME - this is the global nat-ip and we need the noc01-specific ip -add rule ip filter INPUT ip saddr 38.145.60.16 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 38.145.60.15 tcp dport 5666 counter accept -add rule ip filter INPUT ip saddr 10.3.163.10 tcp dport 5666 counter accept -# NOTE: This doesn't include 10.3.166.10 -# NOTE: This doesn't include zabbix. +{% include '_nft_accept_ports' %} -{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging_friendly'] %} -# -# In the phx2 datacenter, both production and staging hosts are in the same -# subnet/vlan. We want production hosts to reject connectons from staging group hosts -# to prevent them from interfering with production. There are however a few hosts in -# production we have marked 'staging-friendly' that we do allow staging to talk to for -# mostly read-only data they need. -# -{% for host in groups['staging']|sort %} -{% if 'eth0_ip' in hostvars[host] %}# {{ host }} -add rule ip filter INPUT ip saddr {{ hostvars[host]['eth0_ip'] }} counter reject with icmp type host-prohibited -{% else %}# {{ host }} has no 'eth0_ip' listed -{% endif %} -{% endfor %} -{% endif %} +{% include '_nft_custom_rules' %} +{% include '_nft_accept_end' %} -# if the host/group defines incoming tcp_ports - allow them -{% if tcp_ports is defined %} -{% for port in tcp_ports %} -add rule ip filter INPUT tcp dport {{ port }} counter accept -{% endfor %} -{% endif %} +# This is the special bit for torrents... +{% set _tnr = nft_table_raw %} -# if the host/group defines incoming udp_ports - allow them -{% if udp_ports is defined %} -{% for port in udp_ports %} -add rule ip filter INPUT udp dport {{ port }} counter accept -{% endfor %} -{% endif %} - -# if there are custom rules - put them in as-is -{% if nft_custom_rules is defined %} -{% for rule in nft_custom_rules %} -{{ rule }} -{% endfor %} -{% endif %} - -# otherwise kick everything out -add rule ip filter INPUT counter reject with icmp type host-prohibited -add rule ip filter FORWARD counter reject with icmp type host-prohibited - -add table ip raw -add chain ip raw PREROUTING { type filter hook prerouting priority -300; policy accept; } -add chain ip raw OUTPUT { type filter hook output priority -300; policy accept; } +add table {{_tnr}} +add chain {{_tnr}} PREROUTING { type filter hook prerouting priority -300; policy accept; } +add chain {{_tnr}} OUTPUT { type filter hook output priority -300; policy accept; } # # We don't want to track all the torrent tracker connections, there's too many. # -add rule ip raw PREROUTING tcp dport 6969 counter notrack -add rule ip raw OUTPUT tcp sport 6969 counter notrack +add rule {{_tnr}} PREROUTING tcp dport 6969 counter notrack +add rule {{_tnr}} OUTPUT tcp sport 6969 counter notrack From 3821ea36b5795c0e79f49abad9a7e67eace16c1f Mon Sep 17 00:00:00 2001 From: James Antill Date: Fri, 1 May 2026 12:23:28 -0400 Subject: [PATCH 2/2] Cleanup nft merge. Chg osbuildapi and nft_custom_rules to use nft_table_filter. Signed-off-by: James Antill --- inventory/group_vars/autosign | 2 +- inventory/group_vars/autosign_hardware | 2 +- inventory/group_vars/bastion | 4 +- inventory/group_vars/bastion_stg | 4 +- inventory/group_vars/batcave | 4 +- inventory/group_vars/bodhi_backend | 2 +- inventory/group_vars/bodhi_backend_stg | 2 +- inventory/group_vars/certgetter | 4 +- inventory/group_vars/certgetter_stg | 4 +- inventory/group_vars/copr_hypervisor | 14 +- inventory/group_vars/copr_keygen_aws | 8 +- inventory/group_vars/copr_keygen_dev_aws | 8 +- inventory/group_vars/download | 2 +- inventory/group_vars/ipa | 2 +- inventory/group_vars/ipatuura_stg | 4 +- inventory/group_vars/ipsilon | 4 +- inventory/group_vars/ipsilon_rdu3 | 4 +- inventory/group_vars/ipsilon_stg | 4 +- inventory/group_vars/ipsilon_stg_rdu3 | 4 +- inventory/group_vars/kernel_qa | 2 +- inventory/group_vars/koji | 4 +- inventory/group_vars/kojipkgs | 4 +- inventory/group_vars/openqa_tap_workers | 6 +- inventory/group_vars/os_proxies | 6 +- inventory/group_vars/pagure | 58 +++---- inventory/group_vars/people | 2 +- inventory/group_vars/proxies | 160 +++++++++--------- inventory/group_vars/proxies_stg | 62 +++---- inventory/group_vars/rabbitmq | 16 +- inventory/group_vars/rabbitmq_stg | 16 +- inventory/group_vars/retrace | 4 +- inventory/group_vars/value | 10 +- inventory/group_vars/value_stg | 12 +- .../host_vars/db-fas01.rdu3.fedoraproject.org | 18 +- .../db-fas01.stg.rdu3.fedoraproject.org | 2 +- .../db-koji01.rdu3.fedoraproject.org | 8 +- .../db-koji01.stg.rdu3.fedoraproject.org | 2 +- .../db-riscv-koji01.rdu3.fedoraproject.org | 2 +- .../host_vars/db01.rdu3.fedoraproject.org | 2 +- .../host_vars/db01.stg.rdu3.fedoraproject.org | 2 +- .../host_vars/noc01.rdu3.fedoraproject.org | 10 +- .../nftables/_nft_accept_staging_friends | 13 ++ roles/base/templates/nftables/nftables | 2 + .../base/templates/nftables/nftables.bastion | 2 + .../templates/nftables/nftables.kojibuilder | 30 ++-- .../templates/osbuildapi-update-nft.sh | 14 +- 46 files changed, 284 insertions(+), 267 deletions(-) create mode 100644 roles/base/templates/nftables/_nft_accept_staging_friends diff --git a/inventory/group_vars/autosign b/inventory/group_vars/autosign index 02cd91ccd1..73f28d9e59 100644 --- a/inventory/group_vars/autosign +++ b/inventory/group_vars/autosign @@ -10,7 +10,7 @@ ansible_ifcfg_allowlist: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/autosign_hardware b/inventory/group_vars/autosign_hardware index b4c54b6aeb..27344fac30 100644 --- a/inventory/group_vars/autosign_hardware +++ b/inventory/group_vars/autosign_hardware @@ -2,5 +2,5 @@ # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: autosign diff --git a/inventory/group_vars/bastion b/inventory/group_vars/bastion index f3c30b4447..35edd27445 100644 --- a/inventory/group_vars/bastion +++ b/inventory/group_vars/bastion @@ -8,8 +8,8 @@ # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bastion_stg b/inventory/group_vars/bastion_stg index f1d08f0366..b7bce13f2d 100644 --- a/inventory/group_vars/bastion_stg +++ b/inventory/group_vars/bastion_stg @@ -19,8 +19,8 @@ batcave_ipa_client_shell_groups: [] # custom_rules: ['-A INPUT -s 192.168.100/24 -j REJECT --reject-with icmp-host-prohibited', '-A INPUT -s 10.0.0.0/8 -p udp -m udp --dport 123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' - - 'add rule ip filter INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.100.0/24 counter reject with icmp type host-prohibited' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.0.0.0/8 udp dport 123 counter accept' # # Set this to get fasjson-client cron to make the aliases file # diff --git a/inventory/group_vars/batcave b/inventory/group_vars/batcave index 51a5358481..96d324dd68 100644 --- a/inventory/group_vars/batcave +++ b/inventory/group_vars/batcave @@ -4,8 +4,8 @@ ansible_base: /srv/web/infra # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # # This host is externally reachable # diff --git a/inventory/group_vars/bodhi_backend b/inventory/group_vars/bodhi_backend index 5e58673e3b..c0b4170202 100644 --- a/inventory/group_vars/bodhi_backend +++ b/inventory/group_vars/bodhi_backend @@ -7,7 +7,7 @@ bodhi_message_routing_keys: # Make connections from signing bridges stateless, they break sigul connections # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.5.125.71 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.5.125.71 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/bodhi_backend_stg b/inventory/group_vars/bodhi_backend_stg index 3a8266fd26..e9f7b60028 100644 --- a/inventory/group_vars/bodhi_backend_stg +++ b/inventory/group_vars/bodhi_backend_stg @@ -9,7 +9,7 @@ bodhi_message_routing_keys: # https://bugzilla.redhat.com/show_bug.cgi?id=1283364 # this is sign-bridge01.rdu3 ip 10.16.169.120 custom_rules: ['-A INPUT --proto tcp --sport 44334 --source 10.16.169.120 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.120 tcp sport 44334 counter accept'] host_group: bodhi2 ipa_client_shell_groups: - sysadmin-bodhi diff --git a/inventory/group_vars/certgetter b/inventory/group_vars/certgetter index d4988816fb..c1710af73f 100644 --- a/inventory/group_vars/certgetter +++ b/inventory/group_vars/certgetter @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/certgetter_stg b/inventory/group_vars/certgetter_stg index 177cf1b29b..0f6bf890d9 100644 --- a/inventory/group_vars/certgetter_stg +++ b/inventory/group_vars/certgetter_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' lvm_size: 20000 mem_size: 2048 num_cpus: 2 diff --git a/inventory/group_vars/copr_hypervisor b/inventory/group_vars/copr_hypervisor index 7a2fe21d09..05b3bccb2d 100644 --- a/inventory/group_vars/copr_hypervisor +++ b/inventory/group_vars/copr_hypervisor @@ -31,13 +31,13 @@ nbde_client_bindings: libvirt_host: "{{ inventory_hostname }}" nft_custom_rules: - - add rule ip filter INPUT iifname virbr0 udp dport bootps accept - - add rule ip filter INPUT iifname virbr0 udp dport 53 accept - - add rule ip filter INPUT iifname virbr0 tcp dport ssh accept - - add rule ip filter FORWARD iifname "virbr0" oif != "virbr0" counter accept - - add rule ip filter FORWARD iifname "virbr0" ct state new counter accept - - add rule ip filter FORWARD ct state established,related counter accept - - add rule ip filter FORWARD ip protocol icmp counter accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport bootps accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 udp dport 53 accept + - add rule {{nft_table_filter}} INPUT iifname virbr0 tcp dport ssh accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" oif != "virbr0" counter accept + - add rule {{nft_table_filter}} FORWARD iifname "virbr0" ct state new counter accept + - add rule {{nft_table_filter}} FORWARD ct state established,related counter accept + - add rule {{nft_table_filter}} FORWARD ip protocol icmp counter accept zabbix_macros: CPU.UTIL.CRIT: 100 diff --git a/inventory/group_vars/copr_keygen_aws b/inventory/group_vars/copr_keygen_aws index d5c426591b..e94a546e1a 100644 --- a/inventory/group_vars/copr_keygen_aws +++ b/inventory/group_vars/copr_keygen_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 172.30.2.105 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 52.44.175.77 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.105 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/copr_keygen_dev_aws b/inventory/group_vars/copr_keygen_dev_aws index e64237e875..33308f4ee9 100644 --- a/inventory/group_vars/copr_keygen_dev_aws +++ b/inventory/group_vars/copr_keygen_dev_aws @@ -9,10 +9,10 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 80 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 18.208.10.131 --dport 5167 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' - - 'add rule ip filter INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 172.30.2.11 tcp dport 5167 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 80 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 18.208.10.131 tcp dport 5167 counter accept' freezes: false tcp_ports: [22, # node_exporter/prometheus diff --git a/inventory/group_vars/download b/inventory/group_vars/download index 2e0512579b..e4ae40fcaf 100644 --- a/inventory/group_vars/download +++ b/inventory/group_vars/download @@ -111,7 +111,7 @@ ipa_host_group_desc: Download servers nagios_Check_Services: swap: false nft_block_rules: - - 'add rule ip filter INPUT ip saddr 212.143.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 212.143.41.0/24 counter reject' primary_auth_source: ipa zabbix_macros: 'APACHE.STATUS.PORT': 443 # Proxies appear to ignore port 80 for apache-status diff --git a/inventory/group_vars/ipa b/inventory/group_vars/ipa index 0c023273a0..71f0c59e3d 100644 --- a/inventory/group_vars/ipa +++ b/inventory/group_vars/ipa @@ -1,7 +1,7 @@ --- # Define resources for this group of hosts here. custom_rules: ['-A INPUT -p udp -m udp -s 10.16.0.0/16 --dport 53 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.0.0/16 udp dport 53 counter accept'] host_backup_targets: ['/var/lib/ipa/backup', '/var/log/dirsrv/slapd-FEDORAPROJECT-ORG'] ipa_client_shell_groups: - sysadmin-accounts diff --git a/inventory/group_vars/ipatuura_stg b/inventory/group_vars/ipatuura_stg index 3d09c4e75e..90d5d20b90 100644 --- a/inventory/group_vars/ipatuura_stg +++ b/inventory/group_vars/ipatuura_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipatuura ipa_host_group_desc: IPA-tuura SCIM application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon b/inventory/group_vars/ipsilon index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon +++ b/inventory/group_vars/ipsilon @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_rdu3 b/inventory/group_vars/ipsilon_rdu3 index 74e9f97595..10d54c9dec 100644 --- a/inventory/group_vars/ipsilon_rdu3 +++ b/inventory/group_vars/ipsilon_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipsilon_db_host: "db-fas01.rdu3.fedoraproject.org" diff --git a/inventory/group_vars/ipsilon_stg b/inventory/group_vars/ipsilon_stg index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg +++ b/inventory/group_vars/ipsilon_stg @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/ipsilon_stg_rdu3 b/inventory/group_vars/ipsilon_stg_rdu3 index e911a21f10..8e1b0773b4 100644 --- a/inventory/group_vars/ipsilon_stg_rdu3 +++ b/inventory/group_vars/ipsilon_stg_rdu3 @@ -3,8 +3,8 @@ # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_host_group: ipsilon ipa_host_group_desc: Ipsilon SSO application ipa_client_shell_groups: diff --git a/inventory/group_vars/kernel_qa b/inventory/group_vars/kernel_qa index 593edfd488..cfee9501db 100644 --- a/inventory/group_vars/kernel_qa +++ b/inventory/group_vars/kernel_qa @@ -1,6 +1,6 @@ --- custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.122.0/24 --dport 2049 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.122.0/24 tcp dport 2049 counter accept'] freezes: false ipa_client_shell_groups: - sysadmin-kernel diff --git a/inventory/group_vars/koji b/inventory/group_vars/koji index 9f9b351aee..ec25cd2d60 100644 --- a/inventory/group_vars/koji +++ b/inventory/group_vars/koji @@ -5,8 +5,8 @@ custom_rules: [ '-A INPUT -d 224.0.0.0/8 -j ACCEPT', '-A INPUT -p vrrp -j ACCEPT'] # Needed for keepalived nft_custom_rules: - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' docker_registry: "candidate-registry.fedoraproject.org" ipa_client_shell_groups: - sysadmin-releng diff --git a/inventory/group_vars/kojipkgs b/inventory/group_vars/kojipkgs index b8e6a711bb..e73a655f8a 100644 --- a/inventory/group_vars/kojipkgs +++ b/inventory/group_vars/kojipkgs @@ -6,8 +6,8 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.39 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] # Need for rsync from log01 for logs. nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' ipa_client_shell_groups: - sysadmin-noc - sysadmin-releng diff --git a/inventory/group_vars/openqa_tap_workers b/inventory/group_vars/openqa_tap_workers index ca322db3e0..7fb7eacf15 100644 --- a/inventory/group_vars/openqa_tap_workers +++ b/inventory/group_vars/openqa_tap_workers @@ -2,9 +2,9 @@ # uses interface definition from host vars custom_rules: ['-A FORWARD -i br0 -j ACCEPT', '-A FORWARD -m state -i {{ openqa_tap_iface }} -o br0 --state RELATED,ESTABLISHED -j ACCEPT', '-A INPUT -i br0 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter FORWARD iifname "br0" counter accept' - - 'add rule ip filter FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' - - 'add rule ip filter INPUT iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "br0" counter accept' + - 'add rule {{nft_table_filter}} FORWARD iifname "{{ openqa_tap_iface }}" oifname "br0" ct state related,established counter accept' + - 'add rule {{nft_table_filter}} INPUT iifname "br0" counter accept' # for iptables rules...maybe other stuff in future? both staging # and prod workers are in this group host_group: openqa-tap-workers diff --git a/inventory/group_vars/os_proxies b/inventory/group_vars/os_proxies index 97579daf6a..6d857ed86c 100644 --- a/inventory/group_vars/os_proxies +++ b/inventory/group_vars/os_proxies @@ -6,10 +6,10 @@ custom_rules: [ '-A INPUT -p tcp --dport 22623 --src 38.145.48.0/27 -j ACCEPT'] nft_custom_rules: # Needed for keepalived - - 'add rule ip filter INPUT ip daddr 224.0.0.0/8 counter accept' - - 'add rule ip filter INPUT ip protocol vrrp counter accept' + - 'add rule {{nft_table_filter}} INPUT ip daddr 224.0.0.0/8 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip protocol vrrp counter accept' # machinectl api - - 'add rule ip filter INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 38.145.48.0/27 tcp dport 22623 counter accept' datacenter: cloud host_group: cloud lvm_size: 20000 diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure index eb711ff83c..10fdc94738 100644 --- a/inventory/group_vars/pagure +++ b/inventory/group_vars/pagure @@ -8,35 +8,35 @@ custom_rules: [ '-A INPUT -s 47.76.99.127/32 -j REJECT' ] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 146.174.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 154.222.253.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 146.174.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 154.222.253.0/24 counter reject' # For the MOTD db_backup_dir: ['/backups'] dbs_to_backup: ['pagure'] diff --git a/inventory/group_vars/people b/inventory/group_vars/people index 0d8398988a..2bb85c5fc1 100644 --- a/inventory/group_vars/people +++ b/inventory/group_vars/people @@ -6,7 +6,7 @@ clamscan_paths: # For the MOTD # Neeed for rsync from log01 for logs. custom_rules: ['-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT'] -nft_custom_rules: ['add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept'] git_basepath: / git_daemon_user: nobody git_port: 9418 diff --git a/inventory/group_vars/proxies b/inventory/group_vars/proxies index 48354ae605..68a41a9592 100644 --- a/inventory/group_vars/proxies +++ b/inventory/group_vars/proxies @@ -34,90 +34,90 @@ custom_rules: [ '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.128 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.163.129 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 81.69.171.38 counter reject' - - 'add rule ip filter INPUT ip saddr 175.24.248.206 counter reject' - - 'add rule ip filter INPUT ip saddr 47.76.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.80.0.0/13 counter reject' - - 'add rule ip filter INPUT ip saddr 47.74.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.64.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.224.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.41.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.8.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.0.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.128.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.133.32.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 43.134.128.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.37.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.153.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.159.32.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 43.156.64.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 43.163.0.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 14.153.15.174 counter reject' - - 'add rule ip filter INPUT ip saddr 47.246.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.236.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.235.0.0/16 counter reject' - - 'add rule ip filter INPUT ip saddr 47.240.0.0/14 counter reject' - - 'add rule ip filter INPUT ip saddr 47.244.0.0/15 counter reject' - - 'add rule ip filter INPUT ip saddr 152.53.36.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 66.249.69.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 159.138.218.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 188.75.180.46/32 counter reject' - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' - - 'add rule ip filter INPUT ip saddr 45.78.192.0/18 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.0.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.32.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.40.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.48.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.64.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.80.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.88.0/22 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.92.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.95.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.96.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.98.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.128.0/19 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.160.0/20 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.176.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.184.0/21 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.185.0/24 counter reject' - - 'add rule ip filter INPUT ip saddr 101.47.186.0/23 counter reject' - - 'add rule ip filter INPUT ip saddr 34.159.191.146/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 81.69.171.38 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 175.24.248.206 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.76.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.80.0.0/13 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.74.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.64.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.224.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.41.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.8.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.0.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.128.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.133.32.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.134.128.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.37.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.153.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.159.32.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.156.64.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 43.163.0.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 14.153.15.174 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.246.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.236.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.235.0.0/16 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.240.0.0/14 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 47.244.0.0/15 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.53.36.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 66.249.69.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 159.138.218.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 188.75.180.46/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 45.78.192.0/18 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.0.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.32.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.40.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.48.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.64.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.80.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.88.0/22 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.92.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.95.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.96.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.98.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.128.0/19 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.160.0/20 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.176.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.184.0/21 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.185.0/24 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 101.47.186.0/23 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 34.159.191.146/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 209.132.181.102 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.124 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.125 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.126 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.65 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.127 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.128 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.129 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/proxies_stg b/inventory/group_vars/proxies_stg index ca008b80e5..dbac0ed582 100644 --- a/inventory/group_vars/proxies_stg +++ b/inventory/group_vars/proxies_stg @@ -11,44 +11,44 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.16.163.0/24 --dport 6081 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.115 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.116 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.117 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.118 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.119 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.120 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.121 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.122 -j ACCEPT', '-A INPUT -p tcp -m tcp --dport 22623 -s 10.16.166.123 -j ACCEPT'] nft_block_rules: - - 'add rule ip filter INPUT ip saddr 2.57.121.144/32 counter reject' + - 'add rule {{nft_table_filter}} INPUT ip saddr 2.57.121.144/32 counter reject' nft_custom_rules: # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' # Need for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.50 tcp dport 873 counter accept' # allow varnish from localhost - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 127.0.0.1 tcp dport 6082 counter accept' # also allow varnish from internal for purge requests - - 'add rule ip filter INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.0/24 tcp dport 6081 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.115 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.116 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.117 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.118 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.119 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.120 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.121 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.122 tcp dport 22623 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.123 tcp dport 22623 counter accept' external: true ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/rabbitmq b/inventory/group_vars/rabbitmq index 4965d0f9ad..4eb052b181 100644 --- a/inventory/group_vars/rabbitmq +++ b/inventory/group_vars/rabbitmq @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/rabbitmq_stg b/inventory/group_vars/rabbitmq_stg index c49e840c32..de7aae5d30 100644 --- a/inventory/group_vars/rabbitmq_stg +++ b/inventory/group_vars/rabbitmq_stg @@ -9,16 +9,16 @@ custom_rules: [ ] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Inter-node traffic - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' # In RDU3 - - 'add rule ip filter INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.78 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.79 tcp dport 25672 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.80 tcp dport 25672 counter accept' ipa_host_group: rabbitmq ipa_host_group_desc: RabbitMQ service ipa_shell_groups: diff --git a/inventory/group_vars/retrace b/inventory/group_vars/retrace index 40975a18a6..7a655ce4a2 100644 --- a/inventory/group_vars/retrace +++ b/inventory/group_vars/retrace @@ -3,8 +3,8 @@ custom_rules: - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 2049 -j ACCEPT' - '-A INPUT -p tcp -m tcp -s 10.5.78.11 --dport 5432 -j ACCEPT' nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' - - 'add rule ip filter INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 2049 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.5.78.11 tcp dport 5432 counter accept' env: production freezes: false ipa_client_shell_groups: diff --git a/inventory/group_vars/value b/inventory/group_vars/value index 6321063d96..9e794d8352 100644 --- a/inventory/group_vars/value +++ b/inventory/group_vars/value @@ -10,13 +10,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Needed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: prod ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/group_vars/value_stg b/inventory/group_vars/value_stg index 02e65cdfdf..b6c3cea5ba 100644 --- a/inventory/group_vars/value_stg +++ b/inventory/group_vars/value_stg @@ -10,14 +10,14 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.16.163.35 --dport 5050 -j ACCEPT'] nft_custom_rules: # Neeed for rsync from log01 for logs. - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # Needed to let nagios on noc01 and noc02 (noc01.stg) pipe alerts to zodbot here - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' - - 'add rule ip filter INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 152.19.134.192 tcp dport 5050 counter accept' # batcave01 also needs access to announce commits. - - 'add rule ip filter INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.35 tcp dport 5050 counter accept' deployment_type: stg ipa_client_shell_groups: - fi-apprentice diff --git a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org index 593c7e5fbe..795abe9429 100644 --- a/inventory/host_vars/db-fas01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.rdu3.fedoraproject.org @@ -4,17 +4,17 @@ # nft_custom_rules: # Openshift nodes (egress policy will block connection from non-authorized projects) - - 'add rule ip filter INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.69 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.70 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.71 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.72 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.73 tcp dport 5432 counter accept' # noc01 needs to connect to check the db - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # Ipsilon VMs - - 'add rule ip filter INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.106 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.117 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org index c8b25167e0..6cacb03829 100644 --- a/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-fas01.stg.rdu3.fedoraproject.org @@ -5,7 +5,7 @@ # # TODO: lock it down more nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.166.0/24 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - fas2 diff --git a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org index 8b3fa3900a..28e3fe8db6 100644 --- a/inventory/host_vars/db-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.rdu3.fedoraproject.org @@ -3,10 +3,10 @@ # Only allow postgresql access from the frontend node. # nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.104 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.105 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.169.10 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.10 tcp dport 5432 counter accept' # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org index 7c0ad3f451..2b120673a3 100644 --- a/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-koji01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # Only allow postgresql access from the frontend node. # -nft_custom_rules: ['add rule ip filter INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT ip saddr 10.16.167.64 tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - koji diff --git a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org index 332c62b5a6..ddfa86353d 100644 --- a/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db-riscv-koji01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # This is a generic list, monitored by collectd custom_rules: ['-A INPUT -p tcp -m tcp -s 10.16.172.21 --dport 5432 -j ACCEPT'] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.172.21 tcp dport 5432 counter accept' databases: - koji datacenter: rdu3 diff --git a/inventory/host_vars/db01.rdu3.fedoraproject.org b/inventory/host_vars/db01.rdu3.fedoraproject.org index e4c6b175d9..f626ec2a52 100644 --- a/inventory/host_vars/db01.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - anitya diff --git a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org index c8ade85061..687ac8513e 100644 --- a/inventory/host_vars/db01.stg.rdu3.fedoraproject.org +++ b/inventory/host_vars/db01.stg.rdu3.fedoraproject.org @@ -2,7 +2,7 @@ # # We should narrow this down at some point # -nft_custom_rules: ['add rule ip filter INPUT tcp dport 5432 counter accept'] +nft_custom_rules: ['add rule {{nft_table_filter}} INPUT tcp dport 5432 counter accept'] # This is a generic list, monitored by collectd databases: - askfedora diff --git a/inventory/host_vars/noc01.rdu3.fedoraproject.org b/inventory/host_vars/noc01.rdu3.fedoraproject.org index f8b1f05238..53e7ab1f17 100644 --- a/inventory/host_vars/noc01.rdu3.fedoraproject.org +++ b/inventory/host_vars/noc01.rdu3.fedoraproject.org @@ -6,13 +6,13 @@ custom_rules: [ '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT' ] nft_custom_rules: - - 'add rule ip filter INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.20 tcp dport 5666 counter accept' # needed to allow rsync from log01 - - 'add rule ip filter INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' - - 'add rule ip filter INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.163.39 tcp dport 873 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 192.168.1.59 tcp dport 873 counter accept' # needed to allow 8080 (firmware-proxy from iDRAC mgmt vlans - - 'add rule ip filter INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' - - 'add rule ip filter INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.160.0/24 tcp dport 8080 counter accept' + - 'add rule {{nft_table_filter}} INPUT ip saddr 10.16.161.0/24 tcp dport 8080 counter accept' datacenter: rdu3 eth0_ipv4_gw: 10.16.163.254 eth0_ipv4_ip: 10.16.163.10 diff --git a/roles/base/templates/nftables/_nft_accept_staging_friends b/roles/base/templates/nftables/_nft_accept_staging_friends new file mode 100644 index 0000000000..f7fd1a0a56 --- /dev/null +++ b/roles/base/templates/nftables/_nft_accept_staging_friends @@ -0,0 +1,13 @@ +# _nft_accept_staging_friends + +{% if env != 'staging' and datacenter == 'rdu3' and inventory_hostname not in groups['staging_friendly'] %} +# +# In the rdu3 datacenter, both production and staging hosts are in different +# vlans, and different subnets. However, just as a precaution, we want prod machines to +# reject connections from any staging host just in case there's some globally enabled port. +# There are however a few hosts in production we have marked 'staging-friendly' +# that we do allow staging to talk to for mostly read-only data they need. +# +add rule {{_tn}} INPUT ip saddr 10.16.166.0/24 counter reject with icmp type host-prohibited +add rule {{_tn}} INPUT ip saddr 10.16.167.0/24 counter reject with icmp type host-prohibited +{% endif %} diff --git a/roles/base/templates/nftables/nftables b/roles/base/templates/nftables/nftables index 00904a7306..8d96da9f4c 100644 --- a/roles/base/templates/nftables/nftables +++ b/roles/base/templates/nftables/nftables @@ -11,6 +11,8 @@ {% include '_nft_accept_vpn' %} +{% include '_nft_accept_staging_friends' %} + {% include '_nft_block_rules' %} {% include '_nft_accept_ports' %} diff --git a/roles/base/templates/nftables/nftables.bastion b/roles/base/templates/nftables/nftables.bastion index 4aabe7bb87..f3a3cde524 100644 --- a/roles/base/templates/nftables/nftables.bastion +++ b/roles/base/templates/nftables/nftables.bastion @@ -17,6 +17,8 @@ add rule {{_tn}} INPUT ip saddr 192.168.0.0/24 tcp dport 25 counter accept # This rejects all VPN traffic at the end. 192.168.100.0/24 {% include '_nft_accept_vpn' %} +{% include '_nft_accept_staging_friends' %} + add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 25 counter accept {% if datacenter == 'rdu3' %} diff --git a/roles/base/templates/nftables/nftables.kojibuilder b/roles/base/templates/nftables/nftables.kojibuilder index 1a6a10a21c..8ad3424d09 100644 --- a/roles/base/templates/nftables/nftables.kojibuilder +++ b/roles/base/templates/nftables/nftables.kojibuilder @@ -31,33 +31,33 @@ add rule {{_tn}} OUTPUT ip daddr 10.16.0.17 tcp dport 80 counter accept add rule {{_tn}} OUTPUT ip daddr 10.16.0.35 tcp dport 80 counter accept add rule {{_tn}} OUTPUT ip daddr 10.1.102.24 tcp dport 80 counter accept add rule {{_tn}} OUTPUT ip daddr 10.1.102.50 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.169.106 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.169.107 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.106 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.107 tcp dport 80 counter accept {% endif %} # tang for buildhw -add rule {{_tn}} OUTPUT ip daddr 10.3.163.37 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.38 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.37 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.38 tcp dport 80 counter accept # DNS -add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 udp dport 53 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.33 tcp dport 53 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 udp dport 53 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.34 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.33 tcp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 udp dport 53 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.34 tcp dport 53 counter accept # bastion smtp -add rule {{_tn}} OUTPUT ip daddr 10.3.163.31 tcp dport 25 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.31 tcp dport 25 counter accept # infra.fp.o -add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 80 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.163.35 tcp dport 443 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 80 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.35 tcp dport 443 counter accept # rsyslog out to log01 -add rule {{_tn}} OUTPUT ip daddr 10.3.163.39 tcp dport 514 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.163.39 tcp dport 514 counter accept # SSH -add rule {{_tn}} INPUT ip saddr 10.3.160.0/19 tcp dport 22 counter accept -add rule {{_tn}} OUTPUT ip daddr 10.3.160.0/19 tcp sport 22 counter accept +add rule {{_tn}} INPUT ip saddr 10.16.160.0/19 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.160.0/19 tcp sport 22 counter accept # add rdu3 ansible control host for now add rule {{_tn}} INPUT ip saddr 10.16.163.35/32 tcp dport 22 counter accept add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept @@ -66,7 +66,7 @@ add rule {{_tn}} OUTPUT ip daddr 10.16.163.35/19 tcp sport 22 counter accept {% if inventory_hostname.startswith (('buildvm-s390x-11', 'buildvm-s390x-12', 'buildvm-s390x-13')) %} # Allow SSHFS binding to koji01 -add rule {{_tn}} OUTPUT ip daddr 10.3.169.104 tcp dport 22 counter accept +add rule {{_tn}} OUTPUT ip daddr 10.16.169.104 tcp dport 22 counter accept {% endif %} # http to pull sources from pkgs lookaside diff --git a/roles/koji_builder/templates/osbuildapi-update-nft.sh b/roles/koji_builder/templates/osbuildapi-update-nft.sh index 7c729551ad..79fce3aa3a 100644 --- a/roles/koji_builder/templates/osbuildapi-update-nft.sh +++ b/roles/koji_builder/templates/osbuildapi-update-nft.sh @@ -14,16 +14,16 @@ # 2. Checking if it exists and failing with a "nice" message, if it doesn't. # 3. Waiting for it to exist. -# if ! nft list set ip filter osbuildapi >& /dev/null; then +# if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then # exit 0 # fi -if ! nft list set ip filter osbuildapi >& /dev/null; then - echo "OSBUILD: nft set ip filter osbuildapi: Doesn't exist" 1>&2; +if ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; then + echo "OSBUILD: nft set {{nft_table_filter}} osbuildapi: Doesn't exist" 1>&2; exit 2 fi -while ! nft list set ip filter osbuildapi >& /dev/null; do +while ! nft list set {{nft_table_filter}} osbuildapi >& /dev/null; do sleep 10 done @@ -47,15 +47,15 @@ NEWIDENTITYIPS=`echo "$RESOLVEQUERY" | grep link | sed -E 's/.* ([0-9]+\.[0-9]+\ # Empty the filter: We do this at the end for a small window.` # NOTE: We aren't flushing old entries anymore. # See commit: e7b50aaee469fdded0ea650c7e7f4dd06e929609 -# nft flush set ip filter osbuildapi +# nft flush set {{nft_table_filter}} osbuildapi # Add the IPs... for j in $NEWIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done for j in $NEWIDENTITYIPS do - nft add element ip filter osbuildapi { $j } + nft add element {{nft_table_filter}} osbuildapi { $j } done