update..
This commit is contained in:
@ -122,351 +122,63 @@
|
||||
|
||||
|
||||
# ---
|
||||
# Block Routers
|
||||
# MAC Address Filtering Gaming Devices
|
||||
# ---
|
||||
|
||||
- name: Check if String 'drop_syn_flood..' (IPv4) is present
|
||||
shell: grep -q -E "^#?drop_syn_flood=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: drop_syn_flood_ipv4_present
|
||||
- name: Check if String 'gaming_device_mac_addresses..' (IPv4) is present
|
||||
shell: grep -q -E "^#?gaming_device_mac_addresses=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: gaming_device_mac_addresses_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "drop_syn_flood_ipv4_present.rc > 1"
|
||||
changed_when: "drop_syn_flood_ipv4_present.rc > 0"
|
||||
failed_when: "gaming_device_mac_addresses_ipv4_present.rc > 1"
|
||||
changed_when: "gaming_device_mac_addresses_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (drop_syn_flood)
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (gaming_device_mac_addresses)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*protect_against_several_attacks=true'
|
||||
insertafter: '^#?\s*allow_remote_mac_src_addresses='
|
||||
block: |
|
||||
|
||||
# Protection against syn-flooding
|
||||
#
|
||||
#drop_syn_flood=false
|
||||
# =============
|
||||
# - MAC Address Filtering Gaming Devices
|
||||
# =============
|
||||
|
||||
# - I have to say that fragments scare me more than anything.
|
||||
# - Sending lots of non-first fragments was what allowed Jolt2 to effectively "drown"
|
||||
# - Firewall-1. Fragments can be overlapped, and the subsequent interpretation of such
|
||||
# - fragments is very OS-dependent (see this paper for details).
|
||||
# - I am not going to trust any fragments.
|
||||
# - Log fragments just to see if we get any, and deny them too
|
||||
# - MAC adresses here are only allowed connect to internet but NOT to loacl services and networks
|
||||
# -
|
||||
# - !! 'drop_fragments' does not work within telekom mobile connections !!
|
||||
# - Blank separated list
|
||||
# -
|
||||
#drop_fragments=true
|
||||
|
||||
# drop new packages without syn flag
|
||||
#
|
||||
#drop_new_not_sync=true
|
||||
|
||||
# drop invalid packages
|
||||
#
|
||||
#drop_invalid_state=true
|
||||
|
||||
# drop packages with unusal flags
|
||||
#
|
||||
#drop_invalid_flags=true
|
||||
|
||||
# Refuse private addresses on extern interfaces
|
||||
#
|
||||
# Refuse packets claiming to be from a
|
||||
# Class A private network
|
||||
# Class B private network
|
||||
# Class C private network
|
||||
# loopback interface
|
||||
# Class D multicast address
|
||||
# Class E reserved IP address
|
||||
# broadcast address
|
||||
#drop_spoofed=true
|
||||
|
||||
# Don't allow spoofing from that server
|
||||
#
|
||||
#drop_spoofed_out=true
|
||||
|
||||
# Refusing packets claiming to be to the loopback interface protects against
|
||||
# source quench, whereby a machine can be told to slow itself down by an icmp source
|
||||
# quench to the loopback.
|
||||
#drop_ext_to_lo=true
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (drop_syn_flood)"
|
||||
gaming_device_mac_addresses=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (gaming_device_mac_addresses)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- drop_syn_flood_ipv4_present is changed
|
||||
- gaming_device_mac_addresses_ipv4_present is changed
|
||||
|
||||
|
||||
- name: Check if String 'drop6_syn_flood..' (IPv6) is present
|
||||
- name: Check if String 'gaming_device_mac_addresses..' (IPv6) is present
|
||||
shell: grep -q -E "^#?drop6_syn_flood=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: drop6_syn_flood_ipv6_present
|
||||
register: gaming_device_mac_addresses_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "drop6_syn_flood_ipv6_present.rc > 1"
|
||||
changed_when: "drop6_syn_flood_ipv6_present.rc > 0"
|
||||
failed_when: "gaming_device_mac_addresses_ipv6_present.rc > 1"
|
||||
changed_when: "gaming_device_mac_addresses_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (drop6_syn_flood)
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (gaming_device_mac_addresses)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*protect6_against_several_attacks=true'
|
||||
insertafter: '^#?\s*allow_remote_mac_src_addresses='
|
||||
block: |
|
||||
|
||||
# Protection against syn-flooding
|
||||
#
|
||||
#drop6_syn_flood=false
|
||||
# =============
|
||||
# - MAC Address Filtering Gaming Devices
|
||||
# =============
|
||||
|
||||
# drop new packages without syn flag
|
||||
#
|
||||
#drop6_new_not_sync=true
|
||||
|
||||
# drop invalid packages
|
||||
#
|
||||
#drop6_invalid_state=true
|
||||
|
||||
# drop packages with unusal flags
|
||||
#
|
||||
#drop6_invalid_flags=true
|
||||
|
||||
# Refuse spoofed packets pretending to be from your IP address.
|
||||
#
|
||||
#drop6_from_own_ip=true
|
||||
|
||||
# Refuse private addresses on extern interfaces
|
||||
#
|
||||
#drop6_spoofed=true
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (drop6_syn_flood)"
|
||||
# - MAC adresses here are only allowed connect to internet but NOT to loacl services and networks
|
||||
# -
|
||||
# - Blank separated list
|
||||
# -
|
||||
gaming_device_mac_addresses=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (gaming_device_mac_addresses)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- drop6_syn_flood_ipv6_present is changed
|
||||
|
||||
|
||||
# ---
|
||||
# Block UDP/TCP Ports out
|
||||
# ---
|
||||
|
||||
- name: Check if String 'block_udp_extern_out_ports..' (IPv4) is present
|
||||
shell: grep -q -E "^block_udp_extern_out_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: block_udp_extern_out_ports_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "block_udp_extern_out_ports_ipv4_present.rc > 1"
|
||||
changed_when: "block_udp_extern_out_ports_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (block_udp_extern_out_ports)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*block_upnp_traffic_out'
|
||||
block: |
|
||||
|
||||
|
||||
# =============
|
||||
# --- Block UDP Ports out
|
||||
# =============
|
||||
|
||||
# - UDP Ports to block (only extern out)
|
||||
# -
|
||||
# - Comma separated list of udp ports
|
||||
# -
|
||||
block_udp_extern_out_ports=""
|
||||
|
||||
|
||||
# =============
|
||||
# --- Block TCP Ports out
|
||||
# =============
|
||||
|
||||
# - TCP Ports to block (only extern out)
|
||||
# -
|
||||
# - Comma separated list of tcp ports
|
||||
# -
|
||||
block_tcp_extern_out_ports="${standard_turn_service_ports}"
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (block_udp_extern_out_ports)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- block_udp_extern_out_ports_ipv4_present is changed
|
||||
|
||||
|
||||
- name: Check if String 'block_udp_extern_out_ports..' (IPv6) is present
|
||||
shell: grep -q -E "^block_udp_extern_out_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: block_udp_extern_out_ports_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "block_udp_extern_out_ports_ipv6_present.rc > 1"
|
||||
changed_when: "block_udp_extern_out_ports_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (block_udp_extern_out_ports)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*block_upnp_traffic_out'
|
||||
block: |
|
||||
|
||||
|
||||
# =============
|
||||
# --- Block UDP Ports out
|
||||
# =============
|
||||
|
||||
# - UDP Ports to block (only extern out)
|
||||
# -
|
||||
# - Comma separated list of udp ports
|
||||
# -
|
||||
block_udp_extern_out_ports=""
|
||||
|
||||
|
||||
# =============
|
||||
# --- Block TCP Ports out
|
||||
# =============
|
||||
|
||||
# - TCP Ports to block (only extern out)
|
||||
# -
|
||||
# - Comma separated list of tcp ports
|
||||
# -
|
||||
block_tcp_extern_out_ports=""
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (block_udp_extern_out_ports)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- block_udp_extern_out_ports_ipv6_present is changed
|
||||
|
||||
|
||||
# ---
|
||||
# jitsi video conference service
|
||||
# ---
|
||||
|
||||
- name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present
|
||||
shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: jitsi_service_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "jitsi_service_ipv4_present.rc > 1"
|
||||
changed_when: "jitsi_service_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*mumble_ports'
|
||||
block: |
|
||||
|
||||
# ======
|
||||
# - Jitsi Video Conference Service
|
||||
# ======
|
||||
|
||||
# - Jitsi Video Conference Service Gateway
|
||||
# -
|
||||
# - NOT YET IMPLEMENTED
|
||||
# -
|
||||
local_jitsi_video_conference_service=false
|
||||
|
||||
# - Jitsi Video Conference Service Ports
|
||||
# -
|
||||
# - TCP 80: Webinterface.
|
||||
# - TCP 443: Webinterface (SSL)
|
||||
# -
|
||||
# - UDP 10000-20000: Virtual Media for Remote Console
|
||||
# -
|
||||
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
|
||||
jitsi_udp_ports="$standard_jitsi_udp_port_range"
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- jitsi_service_ipv4_present is changed
|
||||
|
||||
- name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present
|
||||
shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: jitsi_service_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "jitsi_service_ipv6_present.rc > 1"
|
||||
changed_when: "jitsi_service_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*mumble_ports'
|
||||
block: |
|
||||
|
||||
# ======
|
||||
# - Jitsi Video Conference Service
|
||||
# ======
|
||||
|
||||
# - Jitsi Video Conference Service Gateway
|
||||
# -
|
||||
# - NOT YET IMPLEMENTED
|
||||
# -
|
||||
local_jitsi_video_conference_service=false
|
||||
|
||||
# - Jitsi Video Conference Service Ports
|
||||
# -
|
||||
# - TCP 80: Webinterface.
|
||||
# - TCP 443: Webinterface (SSL)
|
||||
# -
|
||||
# - UDP 10000-20000: Virtual Media for Remote Console
|
||||
# -
|
||||
jitsi_tcp_ports="$standard_jitsi_tcp_ports"
|
||||
jitsi_udp_ports="$standard_jitsi_udp_port_range"
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- jitsi_service_ipv6_present is changed
|
||||
|
||||
|
||||
# ---
|
||||
# TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
||||
# ---
|
||||
|
||||
- name: Check if String 'nc_turn_ports=..' (IPv4) is present
|
||||
shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv4.conf
|
||||
register: nc_turn_service_ipv4_present
|
||||
when: main_ipv4_exists.stat.exists
|
||||
failed_when: "nc_turn_service_ipv4_present.rc > 1"
|
||||
changed_when: "nc_turn_service_ipv4_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (nc's turn service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv4.conf
|
||||
insertafter: '^#?\s*jitsi_udp_ports'
|
||||
block: |
|
||||
|
||||
# ======
|
||||
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
||||
# ======
|
||||
|
||||
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
||||
# -
|
||||
# - NOT YET IMPLEMENTED
|
||||
# -
|
||||
local_nc_turn_service=""
|
||||
|
||||
# - Ports used by local TURN Server (Stun Server)
|
||||
# -
|
||||
# - comma separated list
|
||||
# -
|
||||
nc_turn_ports="$standard_turn_service_ports"
|
||||
nc_turn_udp_ports="$standard_turn_service_udp_ports"
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)"
|
||||
when:
|
||||
- main_ipv4_exists.stat.exists
|
||||
- nc_turn_service_ipv4_present is changed
|
||||
|
||||
- name: Check if String 'nc_turn_ports=..' (IPv6) is present
|
||||
shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv6.conf
|
||||
register: nc_turn_service_ipv6_present
|
||||
when: main_ipv6_exists.stat.exists
|
||||
failed_when: "nc_turn_service_ipv6_present.rc > 1"
|
||||
changed_when: "nc_turn_service_ipv6_present.rc > 0"
|
||||
|
||||
- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
|
||||
blockinfile:
|
||||
path: /etc/ipt-firewall/main_ipv6.conf
|
||||
insertafter: '^#?\s*jitsi_udp_ports'
|
||||
block: |
|
||||
|
||||
# ======
|
||||
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
||||
# ======
|
||||
|
||||
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
||||
# -
|
||||
# - NOT YET IMPLEMENTED
|
||||
# -
|
||||
local_nc_turn_service=""
|
||||
|
||||
# - Ports used by local TURN Server (Stun Server)
|
||||
# -
|
||||
# - comma separated list
|
||||
# -
|
||||
nc_turn_ports="$standard_turn_service_ports"
|
||||
nc_turn_udp_ports="$standard_turn_service_udp_ports"
|
||||
marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
|
||||
when:
|
||||
- main_ipv6_exists.stat.exists
|
||||
- nc_turn_service_ipv6_present is changed
|
||||
- gaming_device_mac_addresses_ipv6_present is changed
|
||||
|
||||
|
||||
# ---
|
||||
|
||||
Reference in New Issue
Block a user