Skip to content

Commit d7cf1bb

Browse files
bruzinabruzina
committed
feat: nftables firewall
1 parent f63be2c commit d7cf1bb

File tree

11 files changed

+185
-6
lines changed

11 files changed

+185
-6
lines changed

‎README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,13 @@ This Ansible collection provides a set of roles designed for configuring Kubuntu
66

77
### Roles
88

9-
| Role | Description | Dependencies |
10-
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
11-
| [xebis.ansible.apt](roles/apt/README.md) | Deb package updates and upgrades using the apt package manager. Can optionally clean up unused packages and reboot the system if required. | `xebis.ansible.system` |
12-
| `xebis.ansible.openssh_server` | Installs OpenSSH server installation and provides `Restart ssh` handler. | `xebis.ansible.apt` |
13-
| [xebis.ansible.system](roles/system/README.md) | System-related tasks such as reboot handler or reboot when required handler. | |
14-
| [`xebis.ansible.users`](roles/users/README.md) | Ansible role for managing system users. | `xebis.ansible.openssh_server` |
9+
| Role | Description | Dependencies |
10+
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
11+
| [xebis.ansible.apt](roles/apt/README.md) | Deb package updates and upgrades using the apt package manager. Can optionally clean up unused packages and reboot the system if required. | `xebis.ansible.system` |
12+
| [xebis.ansible.nftables_firewall](roles/nftables_firewall/README.md) | nftables firewall | `xebis.ansible.apt` |
13+
| `xebis.ansible.openssh_server` | Installs OpenSSH server and provides `Restart ssh` handler. | `xebis.ansible.apt` |
14+
| [xebis.ansible.system](roles/system/README.md) | System-related tasks such as reboot handler or reboot when required handler. | |
15+
| [`xebis.ansible.users`](roles/users/README.md) | Ansible role for managing system users. | `xebis.ansible.openssh_server` |
1516

1617
## Installation and Configuration
1718

‎roles/nftables_firewall/README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Xebis.Ansible.Nftables_Firewall
2+
3+
`nftables` based extensible firewall chains and rules.
4+
5+
## Tasks
6+
7+
- Installs `nftables` package, creates `/etc/nftables` configuration directory.
8+
- Copies default nftables chains and rules.
9+
- Asynchronously starts and enables nftables service and waits until it is ready.
10+
11+
## Variables
12+
13+
- `nftables_firewall_log_rejected` [boolean]
14+
- Whether to log rejected packets to syslog.
15+
- Default `false`
16+
17+
## Handlers
18+
19+
- `Validate and reload nftables firewall`
20+
- Validates and reloads all `nftables` firewall rules.
21+
- `Reload nftables firewall`
22+
- Reloads all `nftables` firewall rules. Shouldn't be used without prior nftables configuration check.

‎roles/nftables_firewall/files/inet-chain-manual.conf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# File for manually added nftables chains
2+
# Example chain:
3+
#chain inet-manual-example {
4+
# tcp dport 8080 counter accept # Allow testing HTTP traffic
5+
# tcp dport { 2000,3000,4000,5000 } counter accept # Allow usual HTTP ports for applications in development
6+
#}

‎roles/nftables_firewall/files/inet-fwd-manual.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# File for manually added nftables inet fwd rules
2+
# Example rules:
3+
#tcp dport 8080 counter accept # Allow testing HTTP traffic
4+
#ip saddr 192.168.1.0/24 jump inet-manual-example

‎roles/nftables_firewall/files/inet-in-manual.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# File for manually added nftables inet in rules
2+
# Example rules:
3+
#tcp dport 8080 counter accept # Allow testing HTTP traffic
4+
#ip saddr 192.168.1.0/24 jump inet-manual-example

‎roles/nftables_firewall/files/inet-out-manual.conf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# File for manually added nftables inet out rules
2+
# Example rules:
3+
#tcp dport 8080 counter accept # Allow testing HTTP traffic
4+
#ip saddr 192.168.1.0/24 jump inet-manual-example

‎roles/nftables_firewall/handlers/main.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
- name: Validate and reload all nftables firewall rules
3+
become: true
4+
ansible.builtin.command:
5+
cmd: nft -c -f /etc/nftables.conf
6+
changed_when: true
7+
listen: Validate and reload nftables firewall
8+
notify: Reload nftables firewall
9+
10+
- name: Reload all nftables firewall rules
11+
become: true
12+
ansible.builtin.command:
13+
cmd: /etc/nftables.conf
14+
changed_when: true
15+
listen: Reload nftables firewall

‎roles/nftables_firewall/meta/main.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
dependencies:
3+
- role: xebis.ansible.apt # Expects updated apt cache

‎roles/nftables_firewall/tasks/main.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
- name: Install firewall deb packages
3+
become: true
4+
ansible.builtin.apt:
5+
name: nftables
6+
state: present
7+
8+
- name: Create nftables directory
9+
become: true
10+
ansible.builtin.file:
11+
path: /etc/nftables
12+
mode: u=rwx,g=rx,o=rx
13+
state: directory
14+
15+
- name: Copy common firewall rules from template
16+
become: true
17+
ansible.builtin.template:
18+
src: nftables.conf.j2
19+
dest: /etc/nftables.conf
20+
mode: u=rwx,g=r,o=r
21+
validate: nft -c -f %s
22+
notify: Validate and reload nftables firewall
23+
24+
- name: Copy manual firewall rules files
25+
become: true
26+
ansible.builtin.copy:
27+
src: "{{ item }}"
28+
dest: /etc/nftables/{{ item }}
29+
force: false
30+
mode: u=rwx,g=rx,o=rx
31+
with_items:
32+
- inet-in-manual.conf
33+
- inet-fwd-manual.conf
34+
- inet-out-manual.conf
35+
- inet-chain-manual.conf
36+
37+
- name: Start and enable nftables service
38+
become: true
39+
ansible.builtin.systemd:
40+
name: nftables
41+
enabled: true
42+
state: started
43+
register: nftables_service
44+
when: not ansible_check_mode
45+
async: 60
46+
poll: 0
47+
48+
- name: Check on nftables service
49+
become: true
50+
ansible.builtin.async_status:
51+
jid: "{{ nftables_service.ansible_job_id }}"
52+
register: nftables_service_result
53+
when: not ansible_check_mode
54+
until: nftables_service_result.finished
55+
retries: 12
56+
delay: 5

‎roles/nftables_firewall/templates/nftables.conf.j2‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/sbin/nft -f
2+
3+
table inet filter
4+
delete table inet filter
5+
6+
table inet filter {
7+
chain inet-pre {
8+
type filter hook prerouting priority 0; policy drop;
9+
ct state invalid counter drop # Drop invalid and faulty packets
10+
iif != lo ip daddr 127.0.0.0/8 counter drop
11+
iif != lo ip6 daddr ::1 counter drop
12+
counter accept
13+
}
14+
15+
chain inet-in {
16+
type filter hook input priority 0; policy drop;
17+
ct state { established,related } counter accept # Allow traffic from established and related packets
18+
iif lo accept # Allow loopback traffic
19+
ip protocol icmp counter limit rate 10/second accept # Allow all ICMP and IGMP traffic, but enforce a rate limit
20+
ip protocol igmp counter limit rate 10/second accept
21+
ip6 nexthdr icmpv6 counter limit rate 10/second accept
22+
tcp dport 22 counter accept # Allow SSH traffic
23+
include "/etc/nftables/inet-in-*.conf" # Include roles rules
24+
counter {% if nftables_firewall_log_rejected is defined and nftables_firewall_log_rejected %}log prefix "nftables inet-in rejected " {% endif %}reject with icmpx type port-unreachable # Reject
25+
}
26+
27+
chain inet-fwd {
28+
type filter hook forward priority 0; policy drop;
29+
ct state { established,related } counter accept # Allow traffic from established and related packets
30+
ip protocol icmp counter accept # Allow all ICMP and IGMP traffic, but do NOT enforce a rate limit
31+
ip protocol igmp counter accept
32+
ip6 nexthdr icmpv6 counter accept
33+
include "/etc/nftables/inet-fwd-*.conf" # Include roles rules
34+
counter {% if nftables_firewall_log_rejected is defined and nftables_firewall_log_rejected %}log prefix "nftables inet-fwd rejected " {% endif %}reject with icmpx type host-unreachable # Reject
35+
}
36+
37+
chain inet-out {
38+
type filter hook output priority 0; policy drop;
39+
ct state { established,related } counter accept # Allow traffic from established and related packets
40+
oif lo counter accept
41+
ip protocol icmp counter accept # Allow all ICMP and IGMP traffic, but do NOT enforce a rate limit
42+
ip protocol igmp counter accept
43+
ip6 nexthdr icmpv6 counter accept
44+
udp dport 53 counter accept # Allow DNS traffic
45+
tcp dport 53 counter accept
46+
udp dport 123 counter accept # Allow NTP traffic
47+
tcp dport 80 counter accept # Allow HTTP traffic
48+
tcp dport 443 counter accept # Allow HTTPS traffic
49+
tcp dport 22 counter accept # Allow SSH traffic
50+
include "/etc/nftables/inet-out-*.conf" # Include roles rules
51+
counter {% if nftables_firewall_log_rejected is defined and nftables_firewall_log_rejected %}log prefix "nftables inet-out rejected " {% endif %}reject with icmpx type admin-prohibited # Reject
52+
}
53+
54+
chain inet-post {
55+
type filter hook postrouting priority 0; policy drop;
56+
ct state invalid counter drop # Drop invalid and faulty packets
57+
oif != lo ip daddr 127.0.0.0/8 counter drop
58+
oif != lo ip6 daddr ::1 counter drop
59+
counter accept
60+
}
61+
62+
include "/etc/nftables/inet-chain-*.conf" # Include roles chains
63+
}

0 commit comments

Comments
 (0)