84 lines
2.8 KiB
Plaintext
84 lines
2.8 KiB
Plaintext
#cloud-config
|
|
|
|
package_update: true
|
|
package_upgrade: true
|
|
packages:
|
|
- firehol
|
|
|
|
write_files:
|
|
- path: /etc/sysctl.d/99-enable-ip-forward.conf
|
|
content: net.ipv4.ip_forward = 1
|
|
- path: /etc/default/firehol
|
|
content: |
|
|
START_FIREHOL=YES
|
|
WAIT_FOR_IFACE=""
|
|
FIREHOL_ESTABLISHED_ACTIVATION_ACCEPT=0
|
|
- path: /etc/firehol/firehol.conf
|
|
content: |
|
|
public_ip4="$(ip -4 addr show dev eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')"
|
|
public_ip6="$(ip -6 addr show dev eth0 | grep -oP '(?<=inet6\s)[\da-f:]+')"
|
|
|
|
lan_ips4="10.0.0.0/8"
|
|
|
|
server_sieve_ports="tcp/4190"
|
|
client_sieve_ports="4190"
|
|
|
|
server_ssh_alt_ports="tcp/2223"
|
|
client_ssh_alt_ports="2223"
|
|
|
|
server_k3s_ports="tcp/6443"
|
|
client_k3s_ports="6443"
|
|
|
|
LAN="enp7s0"
|
|
WAN="eth0"
|
|
CONTAINERS="vxlan+ flannel+ cni+ cali+ docker+ podman+"
|
|
|
|
version 6
|
|
|
|
# use snat to outgoing ip4 address
|
|
ipv4 snat to "${public_ip4}" outface ${WAN}
|
|
|
|
# enable ipv6 basic stuff on all interfaces
|
|
ipv6 interface any v6interop proto icmpv6
|
|
client ipv6neigh accept
|
|
server ipv6neigh accept
|
|
client ipv6router accept
|
|
server ipv6router accept
|
|
client ipv6mld accept
|
|
server ipv6mld accept
|
|
|
|
policy return
|
|
|
|
# enable dhcpv6 on all interfaces
|
|
ipv6 interface any dhcpv6
|
|
server dhcpv6 accept
|
|
client dhcpv6 accept
|
|
|
|
policy return
|
|
|
|
# allow everything on lan, containers
|
|
interface "${LAN} ${CONTAINERS}" lan
|
|
policy accept
|
|
|
|
# protect from the internet
|
|
interface46 "${WAN}" internet src4 not "${UNROUTABLE_IPS}" dst4 "${public_ip4}" src6 not "${UNROUTABLE_IPS}" dst6 "${public_ip6}"
|
|
protection strong
|
|
client all accept
|
|
|
|
server ident reject with tcp-reset
|
|
|
|
server "ssh http https" accept
|
|
server "pop3 pop3s smtp smtps imap imaps sieve ssh_alt k3s" accept
|
|
|
|
# Accept all traffic from the container interfaces towards the internet or towards other containers. Note that
|
|
# This doesn't mean all traffic is allowed, since Kubernetes will have its own rules that will beat these.
|
|
router containers inface "${LAN} ${CONTAINERS}" outface "${LAN} ${CONTAINERS} ${WAN}"
|
|
policy accept
|
|
|
|
# Connection between internet and lan
|
|
router internet2lan inface ${WAN} outface ${LAN}
|
|
client all accept # allow all outgoing traffic, but I do think this is redundant with the containers policy
|
|
|
|
runcmd:
|
|
- systemctl enable --now firehol
|