Added iptables role

This commit is contained in:
Darks 2020-09-10 19:32:37 +02:00
parent 62192abbc5
commit 065b5d42a8
Signed by: Darks
GPG Key ID: F61F10FA138E797C
5 changed files with 127 additions and 1 deletions

9
iptables.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: Update iptables configuration
hosts: all
become: yes
become_user: root
become_method: sudo
roles:
- iptables

View File

@ -0,0 +1,35 @@
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [155:26977]
# Réponses
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Localhost
-A INPUT -i lo -j ACCEPT
# Ping
-A INPUT -p ipv6-icmp -j ACCEPT
# SSH
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# HTTP(S)
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
# IRC (TLS)
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6697 -j ACCEPT
# Murmur
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 64738 -j ACCEPT
-A INPUT -i eth0 -p udp --dport 64738 -j ACCEPT
# Tout le reste
-A INPUT -i eth0 -j DROP
# DDOS
-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags RST RST -j DROP
COMMIT

View File

@ -0,0 +1,64 @@
# DDOS
*mangle
:PREROUTING ACCEPT [176:18588]
:INPUT ACCEPT [176:18588]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [157:27472]
:POSTROUTING ACCEPT [157:27472]
-A PREROUTING -f -j DROP
-A PREROUTING -m conntrack --ctstate INVALID -j DROP
-A PREROUTING -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
-A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [155:26977]
# Réponses
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Localhost
-A INPUT -i lo -j ACCEPT
# Ping
-A INPUT -p icmp -j ACCEPT
# SSH
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# HTTP(S)
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
# IRC (TLS)
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6697 -j ACCEPT
# Murmur
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 64738 -j ACCEPT
-A INPUT -i eth0 -p udp --dport 64738 -j ACCEPT
# v42 reverse shell
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6068 -j ACCEPT
# Tout le reste
-A INPUT -i eth0 -j DROP
# DDOS bis
-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags RST RST -j DROP
COMMIT

View File

@ -0,0 +1,18 @@
---
- name: "Install openssh" # Yeah I know, quite useless
pacman:
name: "openssh"
state: present
- name: "Copy rules"
template:
src: '{{ item }}'
dest: '/etc/iptables/'
owner: 'root'
mode: 0644
with_fileglob: '*.rules'
- name: "Restarting iptables"
service:
name: "iptables"
state: reloaded

View File

@ -1,5 +1,5 @@
---
- name: Update Nginx configuration
- name: Update sshd configuration
hosts: all
become: yes
become_user: root