This roles allow configuration of firewall rules

⚠️ Please take note that the entire role is built on the concept of "Nothing is allowed except what is allowed"

This role is available for Debian, Ubuntu and CentOS

At this day the role can be used to configure :

• IPv4 firewall rules

The IPv6 feature exist but has not been tested yet, so I discourage you to use it before I've performed some tests The firewalld is not implemented because I consider this tools as to high-level to manage iptables rules. So it's that why I've decide (for now) to not use it.

• Port knocking security

• The role accept this list of parameters

• In each list of rules, each rules can take the following key-value (according to the condition at the right)

For the syntax of the interface name, please refer to the man 8 iptables

The port knocking configuration consists in iptables__knock_rules dictionary. This dictionnary must contains a key per knocking rule. Under each of theses keys you must put some of the following items :

The knock configuration create automatically an iptables chain which the name of the key prefixed by 'KNOCK_'. Each rules created by the knockd daemon will be put into the associated chain.

⚠️ A rule will be automatically added to the list of filter rule. This one will contains all iptables spec from the 'rule' bloc of the corrsponding item in iptables__knock_rules. This rule will redirect all matching packets into the firewall table.

• Simple rule to open port 53 from any host

iptables__filter_rules:
  - chain: input
    protocol: tcp
    source_address: 0.0.0.0/0
    in_interface: eth0
    destination_address: 172.16.0.0/12
    destination_port: 53
    comment: "Allow DNS queries from anyone"
    target: accept

• Simple rule with automatic interface address lookup from ansible host vars

iptables__filter_rules:
  - chain: input
    protocol: tcp
    source_address: 172.16.0.0/12
    in_interface: eth0
    destination_address: "{{ hostvars[inventory_hostname]['ansible_eth0']['ipv4']['address'] }}"
    destination_port: 443
    comment: "Allow HTTPS"
    target: accept

• Complex rule with match sequence

iptables__filter_rules:
  - chain: forward
    protocol: tcp
    in_interface: 'eth0'
    destination_address: 172.16.1.1
    out_interface: 'eth1'
    match: -m multiport --dports 25,143,465,587,993
    comment: "Forward all IMAP/SMTP ports"
    target: accept

• Simple Knock rule

This rule below will create a simple knockd setting

iptables__knock_rules:
  SSH:
    port_sequence: [1234, 4111]
    tcpflags: syn
    sequence_timeout: 5
    window_timeout: 10
    rule:
      chain: input
      protocol: tcp
      in_interface: eth0
      destination_port: 22
      destination_address: 10.0.0.1
      comment: Allow SSH temporary for incoming connection