ppm/ansible-ppm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

support closed ssh range

Browse source
This commit is contained in:
Peter 2026-05-30 19:30:12 +02:00
parent dccb45168c
commit 03d9493e7a
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
roles/baseline/templates/firewall.j2
View file

@ -20,11 +20,16 @@ iptables -A INPUT -m limit --limit 1/s --limit-burst 2 -p icmp --icmp-type echo-
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT
{% if firewall_ssh_ranges is defined %}
{% for range in firewall_ssh_ranges %} {% for range in firewall_ssh_ranges %}
{%if range.type=="ipv4" %} {%if range.type=="ipv4" %}
iptables -A INPUT -p tcp --dport 22 -s {{range.range}} -j ACCEPT # {{range.name}} iptables -A INPUT -p tcp --dport 22 -s {{range.range}} -j ACCEPT # {{range.name}}
{%endif%} {%endif%}
{%endfor%} {%endfor%}
{% else %}
# This server has an open ssh policy
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
{% endif %}
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state INVALID -j DROP iptables -A OUTPUT -m state --state INVALID -j DROP
@ -48,11 +53,16 @@ ip6tables -A INPUT -m limit --limit 1/s --limit-burst 2 -p icmpv6 --icmpv6-type
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
ip6tables -A INPUT -p icmpv6 -j ACCEPT ip6tables -A INPUT -p icmpv6 -j ACCEPT
{% if firewall_ssh_ranges is defined %}
{% for range in firewall_ssh_ranges %} {% for range in firewall_ssh_ranges %}
{%if range.type=="ipv6" %} {%if range.type=="ipv6" %}
ip6tables -A INPUT -p tcp --dport 22 -s {{range.range}} -j ACCEPT # {{range.name}} ip6tables -A INPUT -p tcp --dport 22 -s {{range.range}} -j ACCEPT # {{range.name}}
{%endif%} {%endif%}
{%endfor%} {%endfor%}
{% else %}
# This server has an open ssh policy
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
{% endif %}
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m state --state INVALID -j DROP ip6tables -A OUTPUT -m state --state INVALID -j DROP