From 065b5d42a837880b415897c0c04b5ffc12d35963 Mon Sep 17 00:00:00 2001
From: Darks <l.gatin@neuf.fr>
Date: Thu, 10 Sep 2020 19:32:37 +0200
Subject: [PATCH] Added iptables role

---
 iptables.yml                         |  9 ++++
 roles/iptables/files/ip6tables.rules | 35 +++++++++++++++
 roles/iptables/files/iptables.rules  | 64 ++++++++++++++++++++++++++++
 roles/iptables/tasks/main.yml        | 18 ++++++++
 ssh.yml                              |  2 +-
 5 files changed, 127 insertions(+), 1 deletion(-)
 create mode 100644 iptables.yml
 create mode 100644 roles/iptables/files/ip6tables.rules
 create mode 100644 roles/iptables/files/iptables.rules
 create mode 100644 roles/iptables/tasks/main.yml

diff --git a/iptables.yml b/iptables.yml
new file mode 100644
index 0000000..e955b98
--- /dev/null
+++ b/iptables.yml
@@ -0,0 +1,9 @@
+---
+- name: Update iptables configuration
+  hosts: all
+  become: yes
+  become_user: root
+  become_method: sudo
+
+  roles:
+    - iptables
diff --git a/roles/iptables/files/ip6tables.rules b/roles/iptables/files/ip6tables.rules
new file mode 100644
index 0000000..485217f
--- /dev/null
+++ b/roles/iptables/files/ip6tables.rules
@@ -0,0 +1,35 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [155:26977]
+
+# Réponses
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# Localhost
+-A INPUT -i lo -j ACCEPT
+
+# Ping
+-A INPUT -p ipv6-icmp -j ACCEPT
+
+# SSH
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+
+# HTTP(S)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
+
+# IRC (TLS)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6697 -j ACCEPT
+
+# Murmur
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 64738 -j ACCEPT
+-A INPUT -i eth0 -p udp --dport 64738 -j ACCEPT
+
+# Tout le reste
+-A INPUT -i eth0 -j DROP
+
+# DDOS
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -j DROP
+COMMIT
diff --git a/roles/iptables/files/iptables.rules b/roles/iptables/files/iptables.rules
new file mode 100644
index 0000000..d255a2b
--- /dev/null
+++ b/roles/iptables/files/iptables.rules
@@ -0,0 +1,64 @@
+# DDOS
+*mangle
+:PREROUTING ACCEPT [176:18588]
+:INPUT ACCEPT [176:18588]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [157:27472]
+:POSTROUTING ACCEPT [157:27472]
+-A PREROUTING -f -j DROP
+-A PREROUTING -m conntrack --ctstate INVALID -j DROP
+-A PREROUTING -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
+-A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
+-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
+COMMIT
+
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [155:26977]
+
+# Réponses
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# Localhost
+-A INPUT -i lo -j ACCEPT
+
+# Ping
+-A INPUT -p icmp -j ACCEPT
+
+# SSH
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
+
+# HTTP(S)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
+
+# IRC (TLS)
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6697 -j ACCEPT
+
+# Murmur
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 64738 -j ACCEPT
+-A INPUT -i eth0 -p udp --dport 64738 -j ACCEPT
+
+# v42 reverse shell
+-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6068 -j ACCEPT
+
+# Tout le reste
+-A INPUT -i eth0 -j DROP
+
+# DDOS bis
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
+-A INPUT -p tcp -m tcp --tcp-flags RST RST -j DROP
+COMMIT
diff --git a/roles/iptables/tasks/main.yml b/roles/iptables/tasks/main.yml
new file mode 100644
index 0000000..34a61dc
--- /dev/null
+++ b/roles/iptables/tasks/main.yml
@@ -0,0 +1,18 @@
+---
+- name: "Install openssh" # Yeah I know, quite useless
+  pacman:
+    name: "openssh"
+    state: present
+
+- name: "Copy rules"
+  template:
+    src: '{{ item }}'
+    dest: '/etc/iptables/'
+    owner: 'root'
+    mode: 0644
+  with_fileglob: '*.rules'
+
+- name: "Restarting iptables"
+  service:
+    name: "iptables"
+    state: reloaded
diff --git a/ssh.yml b/ssh.yml
index 44c1b6d..9028324 100644
--- a/ssh.yml
+++ b/ssh.yml
@@ -1,5 +1,5 @@
 ---
-- name: Update Nginx configuration
+- name: Update sshd configuration
   hosts: all
   become: yes
   become_user: root