ansible-iptables for internal & external network firewall configuration

Installation

ansible-galaxy install ernestas-poskus.iptables

Requirements

None.

Dependencies

None.

Role Variables

---
# defaults file for ansible-iptables

##########################
# IPv4 config
##########################

# Default action for: :INPUT DROP
iptables_initial_input_action: DROP

# Default action for: :FORWARD ACCEPT
iptables_initial_forward_action: ACCEPT

# Default action for: :OUTPUT ACCEPT
iptables_initial_output_action: ACCEPT

# Allow loopback interface (localhost)
iptables_allow_loopback: true

# Allow established and related connections
iptables_allow_established_connections: true

# Allow DNS resolution
iptables_allow_dns: false

# Allow NTP traffic for time synchronization
iptables_allow_ntp: true

# Allow ICMP ping requests
iptables_allow_icmp: true

# Internal network supports list:
# - IP's
# - HOSTS (iptables_internal_ips_from_hosts should be enabled)
iptables_internal_network: []

# Internal resolve IP from given host
iptables_internal_ips_from_hosts: false

# Internal hosts interface
iptables_internal_hosts_interface: "{{ ansible_default_ipv4.interface }}"

# Internal network configuration
iptables_internal_ports:
  - '1024:65535'
  - '111' # Portmapper
  - '161:162' # Simple network management protocol (SNMP).
  - '22' # ssh

# Internal network protocols
iptables_internal_protocols:
  - 'tcp'
  - 'udp'

# External network configuration
iptables_external_ports:
  - '22' # ssh

# External network protocols
iptables_external_protocols:
  - 'tcp'

# Additional rules for iptables
iptables_additional_rules: []

# Log dropped packets
iptables_log_dropped_packets: false

# Log limit of dropped packets in minutes
iptables_log_dropped_limit: 15

# LOGGING log level of dropped packets
iptables_log_logging_level: 4

##########################
# IPv6 config
##########################

# Default action for: :INPUT DROP
iptables6_initial_input_action: DROP

# Default action for: :FORWARD ACCEPT
iptables6_initial_forward_action: ACCEPT

# Default action for: :OUTPUT ACCEPT
iptables6_initial_output_action: ACCEPT

# Allow loopback interface (localhost)
iptables6_allow_loopback: true

# Allow established and related connections
iptables6_allow_established_connections: true

# Allow DNS resolution
iptables6_allow_dns: false

# Allow NTP traffic for time synchronization
iptables6_allow_ntp: true

# Allow ICMP ping requests
iptables6_allow_icmp: true

# Internal network supports list:
# - IP's
# - HOSTS (iptables6_internal_ips_from_hosts should be enabled)
iptables6_internal_network: []

# Internal resolve IP from given host
iptables6_internal_ips_from_hosts: false

# Internal hosts interface
iptables6_internal_hosts_interface: "{{ ansible_default_ipv4.interface }}"

# Internal network configuration
iptables6_internal_ports:
  - '1024:65535'
  - '111' # Portmapper
  - '161:162' # Simple network management protocol (SNMP).
  - '22' # ssh

# Internal network protocols
iptables6_internal_protocols:
  - 'tcp'
  - 'udp'

# External network configuration
iptables6_external_ports:
  - '22' # ssh

# External network protocols
iptables6_external_protocols:
  - 'tcp'

# Additional rules for iptables
iptables6_additional_rules: []

# Log dropped packets
iptables6_log_dropped_packets: false

# Log limit of dropped packets in minutes
iptables6_log_dropped_limit: 15

# LOGGING log level of dropped packets
iptables6_log_logging_level: 4

# NAT
iptables_nat_prerouting: ACCEPT
iptables_nat_output: ACCEPT
iptables_nat_postrouting: ACCEPT

iptables4_nat_additional_rules: []

iptables6_nat_additional_rules: []

Example Playbook

Making internal network from given hosts

- name: Configuring iptables
  hosts: all
  sudo: yes
  roles:
    - role: ernestas-poskus.iptables
      iptables_internal_network: "{{ groups['all'] }}"
      iptables_internal_ips_from_hosts: true # when using hosts, this must be enabled
      iptables_log_dropped_packets: true
      iptables_log_dropped_limit: 1

Making internal network from given IP's list

- name: Configuring iptables
  hosts: all
  sudo: yes
  roles:
    - role: ernestas-poskus.iptables
      iptables_internal_network:
       - 192.168.0.1
       - 192.168.0.2
       - 192.168.0.3
      iptables_log_dropped_packets: true
      iptables_log_dropped_limit: 1

License

Copyright (c) 2016, Ernestas Poskus All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

• Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

• Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

• Neither the name of ansible-iptables nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Author Information

Twitter: @ernestas_poskus