diff options
| author | Niklas Yann Wettengel <niyawe@niyawe.de> | 2021-12-12 15:15:03 +0100 |
|---|---|---|
| committer | Niklas Yann Wettengel <niyawe@niyawe.de> | 2021-12-12 15:15:03 +0100 |
| commit | b53a8cf2283b2d6debb94cd399a72d25da0d7c82 (patch) | |
| tree | e91b4b549150219b82e5a3995f0f3515154e2a7e /roles/configure_iptables/templates/iptables.rules | |
| parent | e75acd9a72df39269496abb7207decfc210efaa6 (diff) | |
merge fastd and uplink nodes
Diffstat (limited to 'roles/configure_iptables/templates/iptables.rules')
| -rw-r--r-- | roles/configure_iptables/templates/iptables.rules | 26 |
1 files changed, 2 insertions, 24 deletions
diff --git a/roles/configure_iptables/templates/iptables.rules b/roles/configure_iptables/templates/iptables.rules index 924320d..c3d84dc 100644 --- a/roles/configure_iptables/templates/iptables.rules +++ b/roles/configure_iptables/templates/iptables.rules @@ -4,28 +4,16 @@ :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -{% if 'fastd' in group_names %} {% for site in sites %} -A PREROUTING -i bat{{ site.name }} -j MARK --set-xmark 0x1/0xffffffff {% endfor %} -{% endif %} -{% if 'fastd' in group_names %} -{% for peer in groups['uplink'] %} --A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -j MARK --set-xmark 0x1/0xffffffff -{% endfor %} -{% endif %} -{% if 'uplink' in group_names %} -{% for peer in groups['fastd'] %} --A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -j MARK --set-xmark 0x1/0xffffffff -{% endfor %} -{% for peer in groups['uplink'] | difference([inventory_hostname]) %} +{% for peer in groups['fastd'] | difference([inventory_hostname]) %} -A PREROUTING -i bb{{ hostvars[peer]['wireguard_bb_name'] }} -j MARK --set-xmark 0x1/0xffffffff {% endfor %} {% for peer in wireguard_bb_peers %} -A PREROUTING -i bb{{ peer.name }} -j MARK --set-xmark 0x1/0xffffffff {% endfor %} -{% endif %} COMMIT *filter :INPUT DROP [0:0] @@ -40,7 +28,6 @@ COMMIT # iperf3 -A INPUT -p tcp -m tcp -s 10.222.0.0/16 --dport 5201 -j ACCEPT -{% if 'fastd' in group_names %} # dns -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT @@ -57,13 +44,12 @@ COMMIT -A INPUT -p udp -m udp --dport 10010:10023 -j ACCEPT # wireguard_mesh {% for site in sites %} +-A INPUT -s 10.222.0.0/16 -p udp -m udp --dport {{ site.wireguard_mesh_port }} -j DROP -A INPUT -p udp -m udp --dport {{ site.wireguard_mesh_port }} -j ACCEPT {% endfor %} -{% endif %} # MOSH -A INPUT -p udp -m udp --dport 60000:61000 -j ACCEPT -{% if 'ffrl_uplink' in group_names %} # ffrl-gre {% for peer in ffrl_peers %} -A INPUT -p gre -s {{ peer.remote }} -j ACCEPT @@ -72,15 +58,12 @@ COMMIT {% for peer in ffrl_peers %} -A INPUT -i {{ peer.name }} -p tcp -m tcp --dport 179 -j ACCEPT {% endfor %} -{% endif %} -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped input: " --log-level 4 -{% if 'fastd' in group_names %} {% for site in sites %} -A FORWARD -i bat{{ site.name }} -p udp --dport 10010:10023 -j REJECT {% endfor %} -{% endif %} -A FORWARD -o {{ ansible_default_ipv4.interface }} -j REJECT -A FORWARD -d 10.222.0.0/16 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -s 10.222.0.0/16 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu @@ -91,12 +74,7 @@ COMMIT :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -{% if 'ffrl_uplink' in group_names %} {% for peer in ffrl_peers %} -A POSTROUTING ! -s {{ ffrl_ip4 }} -o {{ peer.name }} -j SNAT --to-source {{ ffrl_ip4 }} {% endfor %} -{% endif %} -{% if 'mullvad_uplink' in group_names %} --A POSTROUTING -o mullvad -j MASQUERADE -{% endif %} COMMIT |