You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+36-11
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,11 @@ After I found out `UFW` was too limited in terms of functionalities, I tried sev
13
13
- Simplicity (not having to learn how role variables would generate the rules)
14
14
- Persistence (reload the rules at boot)
15
15
16
-
This role is an attempt to solve these requirements. It currently supports only ipv4 on Debian and RedHat distributions.
16
+
This role is an attempt to solve these requirements.
17
+
18
+
It supports **ipv4** and **ipv6*** on Debian and RedHat distributions.
19
+
20
+
*ipv6 support was brought up thanks to [@maloddon](https://github.com/maloddon). It is currently in early stages and knowledgable people should review the [default rules](https://github.com/mikegleasonjr/ansible-role-firewall/blob/ipv6/defaults/main.yml). ipv6 rules are not configured by default. If you which to use them, don't forget to set `firewall_v6_configure` to `true`.
17
21
18
22
Requirements
19
23
------------
@@ -28,9 +32,12 @@ Installation
28
32
Role Variables
29
33
--------------
30
34
31
-
There are only 3 dictionaries to override in `defaults/main.yml`:
35
+
`defaults/main.yml`:
32
36
33
37
```
38
+
firewall_v4_configure: true
39
+
firewall_v6_configure: false
40
+
34
41
firewall_v4_default_rules:
35
42
001 default policies:
36
43
- -P INPUT ACCEPT
@@ -47,16 +54,34 @@ firewall_v4_default_rules:
47
54
- -A INPUT -p tcp --dport ssh -j ACCEPT
48
55
999 drop everything:
49
56
- -P INPUT DROP
50
-
51
57
firewall_v4_group_rules: {}
52
-
53
58
firewall_v4_host_rules: {}
54
59
60
+
firewall_v6_default_rules:
61
+
001 default policies:
62
+
- -P INPUT ACCEPT
63
+
- -P OUTPUT ACCEPT
64
+
- -P FORWARD DROP
65
+
002 allow loopback:
66
+
- -A INPUT -i lo -s ::1/128 -d ::1/128 -j ACCEPT
67
+
- -A INPUT -i lo -s fe80::/64 -d fe80::/64 -j ACCEPT
68
+
003 allow ping replies:
69
+
- -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT
70
+
- -A OUTPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
71
+
100 allow established related:
72
+
- -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
73
+
200 allow ssh:
74
+
- -A INPUT -p tcp --dport ssh -j ACCEPT
75
+
999 drop everything:
76
+
- -P INPUT DROP
77
+
firewall_v6_group_rules: {}
78
+
firewall_v6_host_rules: {}
79
+
55
80
```
56
81
57
-
The keys to the dictionaries (`001 default policies`, `002 allow loopback`, ...) can be anything. They are only used for rules **ordering** and **overriding** (explained later). On rules generation, the keys are sorted alphabetically. Hence the 001s and 999s.
82
+
The keys to the `*_rules`dictionaries (`001 default policies`, `002 allow loopback`, ...) can be anything. They are only used for rules **ordering** and **overriding**. On rules generation, the keys are sorted alphabetically. That's why I chose here the 001s and 999s.
58
83
59
-
Those defaults will generate the following script to be executed on the host:
84
+
Those defaults will generate the following script to be executed on the host (for ipv4):
As you can see, the rules are ordered by the dictionary key. You can also observe that you can do pretty much what you want with the rules. In fact, the rules defined in the variables are simply the same rules you would pass to the `iptables` command. You have complete control over the rules syntax.
122
+
As you can see, you have complete control over the rules syntax.
Now that takes care of the default rules. What about overriding?
118
143
119
-
The role provides 2 more variables where you can define more rules. Rules defined in those variables will be merged with the default rules. In fact, rules in `firewall_v4_host_rules` will be merged with `firewall_v4_group_rules`, and then the result will be merged back with the defaults.
144
+
You can change the rules for specific hosts and groups instead of re-defining everything. Rules in `firewall_v4_host_rules` will be merged with `firewall_v4_group_rules`, and then the result will be merged back with the defaults. Same thing for ipv6.
120
145
121
146
This allows 3 levels of rules definition and overriding. I simply chose the names to match how the variable precedence works in Ansible (`all` -> `group` -> `host`). See the example playbook below to see rules overriding in action.
122
147
123
-
Example Playbook
148
+
Example Playbook (ipv4)
124
149
----------------
125
150
126
151
```
@@ -169,11 +194,11 @@ firewall_v4_host_rules:
169
194
200 allow ssh limiting brute force: []
170
195
```
171
196
172
-
That's right, to "delete" rules, you just assign an empty list to an existing dictionary key.
197
+
To "delete" rules, you just assign an empty list to an existing dictionary key.
173
198
174
199
To summarize, rules in `firewall_v4_host_rules` will overwrite rules in `firewall_v4_group_rules`, and then rules in `firewall_v4_group_rules` will overwrite rules in `firewall_v4_default_rules`.
175
200
176
-
You can play with the rules and see the generated script on the host at the following location: `/etc/iptables.v4.generated`.
201
+
You can play with the rules and see the generated script on the host at the following location: `/etc/iptables.v4.generated` and `/etc/iptables.v6.generated`.
0 commit comments