Added iptables role

iptables.yml

@@ -0,0 +1,9 @@
+---
+- name: Update iptables configuration
+  hosts: all
+  become: yes
+  become_user: root
+  become_method: sudo
+
+  roles:
+    - iptables

roles/iptables/files/ip6tables.rules

@@ -0,0 +1,35 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [155:26977]
+
+# Réponses
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# Localhost
+-A INPUT -i lo -j ACCEPT
+
+# Ping
+-A INPUT -p ipv6-icmp -j ACCEPT
+
+# SSH
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+
+# HTTP(S)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
+
+# IRC (TLS)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6697 -j ACCEPT
+
+# Murmur
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 64738 -j ACCEPT
+-A INPUT -i eth0 -p udp --dport 64738 -j ACCEPT
+
+# Tout le reste
+-A INPUT -i eth0 -j DROP
+
+# DDOS
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -j DROP
+COMMIT

roles/iptables/files/iptables.rules

@@ -0,0 +1,64 @@
+# DDOS
+*mangle
+:PREROUTING ACCEPT [176:18588]
+:INPUT ACCEPT [176:18588]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [157:27472]
+:POSTROUTING ACCEPT [157:27472]
+-A PREROUTING -f -j DROP
+-A PREROUTING -m conntrack --ctstate INVALID -j DROP
+-A PREROUTING -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
+-A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
+COMMIT
+
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [155:26977]
+
+# Réponses
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# Localhost
+-A INPUT -i lo -j ACCEPT
+
+# Ping
+-A INPUT -p icmp -j ACCEPT
+
+# SSH
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+
+# HTTP(S)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
+
+# IRC (TLS)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6697 -j ACCEPT
+
+# Murmur
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 64738 -j ACCEPT
+-A INPUT -i eth0 -p udp --dport 64738 -j ACCEPT
+
+# v42 reverse shell
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6068 -j ACCEPT
+
+# Tout le reste
+-A INPUT -i eth0 -j DROP
+
+# DDOS bis
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -j DROP
+COMMIT

roles/iptables/tasks/main.yml

@@ -0,0 +1,18 @@
+---
+- name: "Install openssh" # Yeah I know, quite useless
+  pacman:
+    name: "openssh"
+    state: present
+
+- name: "Copy rules"
+  template:
+    src: '{{ item }}'
+    dest: '/etc/iptables/'
+    owner: 'root'
+    mode: 0644
+  with_fileglob: '*.rules'
+
+- name: "Restarting iptables"
+  service:
+    name: "iptables"
+    state: reloaded

ssh.yml

@@ -1,5 +1,5 @@
 ---
-- name: Update Nginx configuration
+- name: Update sshd configuration
   hosts: all
   become: yes
   become_user: root