You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 

75 lines
2.6 KiB

---
include:
- fwrules.ipsets.management
- fwrules.ipsets.minions
{% set chain_name = "DOCKER-USER" %}
{# [ (service, port, transport, sources), ... ] #}
{% set ports = [
("mqtt-tcp", 1883, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("mqtt-ws", 1884, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("mqtts-tcp", 4883, "tcp", {"ipv4": ["0.0.0.0/0"], "ipv6": ["::/0"]}),
("mqtts-ws", 4884, "tcp", {"ipv4": ["0.0.0.0/0"], "ipv6": ["::/0"]}),
("portainer-agent", 9001, "tcp", {"ipv4": ["set:minions"], "ipv6": ["set:minions"]}),
("icecast-direct", 9090, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("unifi-http", 8080, "tcp", {"ipv4": ["0.0.0.0/0"], "ipv6": ["::/0"]}),
("unifi-https", 8443, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("unifi-portal-http", 8880, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("unifi-portal-https", 8843, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("unifi-speed", 6789, "tcp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
("unifi-stun", 3478, "udp", {"ipv4": ["set:management"], "ipv6": ["set:management"]}),
] %}
{% for family in ["ipv4", "ipv6"] %}
{{ chain_name }} {{ family }}:
iptables.chain_present:
- name: {{ chain_name }}
- family: {{ family }}
{% for service, port, transport, sources in ports %}
{% set addresses, ipsets = salt["minion_net.split_ips_ipsets"](sources.get(family, [])) %}
{% for ipset in ipsets %}
{% set set_name = "{}-{}".format(ipset, family) %}
{{ chain_name }} {{ family }} {{ transport }} {{ service }} {{ ipset }}:
iptables.insert:
- position: 1
- table: filter
- family: {{ family }}
- chain: {{ chain_name }}
- protocol: {{ transport }}
- match: {{ ["set", transport] | tojson }}
- set: {{ set_name }} src
- dport: {{ port }}
- jump: ACCEPT
- require:
- iptables: {{ chain_name }} {{ family }}
{% endfor %}
{% if addresses %}
{{ chain_name }} {{ family }} {{ transport }} {{ service }} addresses:
iptables.insert:
- position: 1
- table: filter
- family: {{ family }}
- chain: {{ chain_name }}
- protocol: {{ transport }}
- match: {{ transport }}
- source: {{ addresses | join(",") }}
- dport: {{ port }}
- jump: ACCEPT
- require:
- iptables: {{ chain_name }} {{ family }}
{% endif %}
{% endfor %}
{{ chain_name }} {{ family }} default deny:
iptables.append:
- table: filter
- family: {{ family }}
- chain: {{ chain_name }}
- jump: DROP
- require:
- iptables: {{ chain_name }} {{ family }}
{% endfor %}