Skip to content

Commit 47b47f2

Browse files
holtaholta
authored
Merge pull request #1677 from holta/firewall-usability
Making IIAB's firewall (iptables) understandable to newbie implementers
2 parents d06e540 + 7fa7d1d commit 47b47f2

File tree

6 files changed

+212
-121
lines changed

6 files changed

+212
-121
lines changed

‎roles/network/tasks/avahi.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,13 @@
1212
owner: avahi
1313
group: avahi
1414
mode: 0640
15-
when: 'gui_wan == True'
15+
#when: 'gui_wan == True'
16+
when: ports_externally_visible|int >= 2
17+
# Where "2" means "ssh + http-or-https (for Admin Console's box.lan/admin too)"
18+
# SEE ~18 line explanation in box near:
19+
# https://github.com/iiab/iiab/blob/master/roles/network/templates/gateway/iiab-gen-iptables#L53-L70
20+
# IF >= 2, Admin Console $gui_port from 0-init determines which port (http-or-https) is opened here:
21+
# https://github.com/iiab/iiab/blob/master/roles/network/templates/gateway/iiab-gen-iptables#L130-L135
1622

1723
- name: Find avahi_ver for clean copy of ssh.service (not debuntu)
1824
shell: "ls /usr/share/doc/ | grep avahi | head -n1"

‎roles/network/templates/gateway/iiab-gen-iptables‎

Lines changed: 149 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -1,165 +1,210 @@
11
#!/bin/bash -x
2-
source {{ iiab_env_file }}
2+
3+
# To customize your iptables firewall, it's best to edit:
4+
# /opt/iiab/iiab/roles/network/templates/gateway/iiab-gen-iptables
5+
# And then run: cd /opt/iiab/iiab; ./iiab-network
6+
37
{% if is_debuntu %}
48
IPTABLES=/sbin/iptables
59
IPTABLES_DATA=/etc/iptables.up.rules
610
{% else %}
711
IPTABLES=/usr/sbin/iptables
812
IPTABLES_DATA=/etc/sysconfig/iptables
913
{% endif %}
10-
LANIF=$IIAB_LAN_DEVICE
11-
WANIF=$IIAB_WAN_DEVICE
12-
MODE=`grep iiab_network_mode_applied {{ iiab_ini_file }} | gawk '{print $3}'`
13-
14-
clear_fw() {
15-
$IPTABLES -F
16-
$IPTABLES -t nat -F
17-
$IPTABLES -X
18-
19-
# first match wins
20-
# Always accept loopback traffic
21-
$IPTABLES -A INPUT -i lo -j ACCEPT
22-
23-
# Always drop rpc
24-
$IPTABLES -A INPUT -p tcp --dport 111 -j DROP
25-
$IPTABLES -A INPUT -p udp --dport 111 -j DROP
26-
# mysql
27-
$IPTABLES -A INPUT -p tcp --dport 3306 -j DROP
28-
$IPTABLES -A INPUT -p udp --dport 3306 -j DROP
29-
# postgres - not needed listens on lo only
30-
$IPTABLES -A INPUT -p tcp --dport 5432 -j DROP
31-
$IPTABLES -A INPUT -p udp --dport 5432 -j DROP
32-
# couchdb
33-
$IPTABLES -A INPUT -p tcp --dport 5984 -j DROP
34-
$IPTABLES -A INPUT -p udp --dport 5984 -j DROP
35-
}
36-
37-
if [ "x$WANIF" == "xnone" ] || [ "$MODE" == "Appliance" ]; then
38-
clear_fw
39-
# save the rule set
40-
{% if is_debuntu %}
41-
netfilter-persistent save
42-
{% else %}
43-
iptables-save > $IPTABLES_DATA
44-
{% endif %}
45-
exit 0
46-
fi
47-
lan=$LANIF
48-
wan=$WANIF
4914

50-
# Good thing we replace this file should be treated like squid below
15+
source {{ iiab_env_file }}
16+
lan=$IIAB_LAN_DEVICE
17+
wan=$IIAB_WAN_DEVICE
18+
echo -e "\nLAN: $lan"
19+
echo -e "WAN: $wan"
20+
#network_mode=`grep iiab_network_mode_applied {{ iiab_ini_file }} | gawk '{print $3}'`
21+
#echo -e "Network Mode: $network_mode\n"
22+
23+
# "Good thing we replace this file; should be treated like Squid below" ?
24+
ports_externally_visible={{ ports_externally_visible }}
25+
#services_externally_visible={{ services_externally_visible }}
5126
gw_block_https={{ gw_block_https }}
5227
ssh_port={{ ssh_port }}
53-
gui_wan={{ gui_wan }}
28+
#gui_wan={{ gui_wan }}
5429
gui_port={{ gui_port }}
5530
iiab_gateway_enabled={{ iiab_gateway_enabled }}
56-
services_externally_visible={{ services_externally_visible }}
31+
block_DNS={{ block_DNS }}
32+
5733
calibre_port={{ calibre_port }}
5834
calibreweb_port={{ calibreweb_port }}
59-
kiwix_port={{ kiwix_port }}
35+
cups_port={{ cups_port }}
6036
kalite_server_port={{ kalite_server_port }}
37+
kiwix_port={{ kiwix_port }}
6138
kolibri_http_port={{ kolibri_http_port }}
62-
cups_port={{ cups_port }}
63-
transmission_http_port={{ transmission_http_port }}
64-
transmission_peer_port={{ transmission_peer_port }}
65-
sugarizer_port={{ sugarizer_port }}
66-
nodered_port={{ nodered_port }}
67-
mosquitto_port={{ mosquitto_port }}
6839
minetest_port={{ minetest_port }}
40+
mosquitto_port={{ mosquitto_port }}
41+
nodered_port={{ nodered_port }}
42+
pbx_enabled={{ pbx_enabled }}
6943
pbx_signaling_ports_chan_sip={{ pbx_signaling_ports_chan_sip }}
7044
pbx_signaling_ports_chan_pjsip={{ pbx_signaling_ports_chan_pjsip }}
7145
pbx_data_ports={{ pbx_data_ports }}
72-
pbx_enabled={{ pbx_enabled }}
73-
samba_enabled={{ samba_enabled }}
46+
sugarizer_port={{ sugarizer_port }}
47+
transmission_http_port={{ transmission_http_port }}
48+
transmission_peer_port={{ transmission_peer_port }}
49+
7450
samba_udp_ports={{ samba_udp_ports }}
7551
samba_tcp_mports={{ samba_tcp_mports }}
7652

77-
block_DNS={{ block_DNS }}
78-
79-
echo "LAN is $lan and WAN is $wan"
80-
#
81-
# delete all existing rules.
82-
#
53+
################################################################################
54+
# #
55+
# IF YOU NEED TO CHANGE ports_externally_visible DO THAT IN: #
56+
# #
57+
# /etc/iiab/local_vars.yml #
58+
# #
59+
# This firewall variable must be an integer {0...5} as follows: #
60+
# #
61+
# 0 = none #
62+
# 1 = ssh only #
63+
# 2 = ssh + http-or-https (for Admin Console's box.lan/admin too) #
64+
# 3 = ssh + http-or-https + common IIAB services <-- THIS IS THE DEFAULT #
65+
# 4 = ssh + http-or-https + common IIAB services + Samba #
66+
# 5 = all but databases #
67+
# #
68+
# Then enable it with iptables by running: cd /opt/iiab/iiab; ./iiab-network #
69+
# #
70+
################################################################################
71+
72+
echo -e "\nports_externally_visible: "$ports_externally_visible"\n"
73+
if ! [ "$ports_externally_visible" -eq "$ports_externally_visible" ] 2> /dev/null; then
74+
echo "EXITING: an integer is required"
75+
exit 1
76+
elif [ "$ports_externally_visible" -lt 0 ] || [ "$ports_externally_visible" -gt 5 ]; then
77+
echo "EXITING: it must be in the range {0...5}"
78+
exit 1
79+
fi
8380

81+
#if [ "$wan" != "none" ] && [ "$network_mode" != "Appliance" ]; then
82+
# Load iptables kernel modules
8483
/sbin/modprobe ip_tables
8584
/sbin/modprobe iptable_filter
8685
/sbin/modprobe ip_conntrack
8786
/sbin/modprobe iptable_nat
88-
clear_fw
87+
#fi
88+
89+
# Delete all existing firewall rules
90+
$IPTABLES -F
91+
$IPTABLES -t nat -F
92+
$IPTABLES -X
93+
94+
# FIRST MATCH WINS - establish iptable rules, starting at the top:
95+
# (verify the resulting rule set by running 'iptables -L -v')
96+
# New to iptables? Run/read 'man iptables' & 'man iptables-extensions'
97+
98+
# Always accept loopback traffic
99+
$IPTABLES -A INPUT -i lo -j ACCEPT
100+
101+
# Disable access to databases, on LAN-side and WAN-side
102+
# SunRPC
103+
$IPTABLES -A INPUT -p tcp --dport 111 -j DROP
104+
$IPTABLES -A INPUT -p udp --dport 111 -j DROP
105+
# MySQL
106+
$IPTABLES -A INPUT -p tcp --dport 3306 -j DROP
107+
$IPTABLES -A INPUT -p udp --dport 3306 -j DROP
108+
# PostgreSQL - not needed listens on lo only
109+
$IPTABLES -A INPUT -p tcp --dport 5432 -j DROP
110+
$IPTABLES -A INPUT -p udp --dport 5432 -j DROP
111+
# CouchDB
112+
$IPTABLES -A INPUT -p tcp --dport 5984 -j DROP
113+
$IPTABLES -A INPUT -p udp --dport 5984 -j DROP
89114

90115
# Allow established connections, and those not coming from the outside
91116
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
92-
$IPTABLES -A INPUT -m state --state NEW -i $lan -j ACCEPT
117+
$IPTABLES -A INPUT -m state --state NEW -i $lan -j ACCEPT
93118

94-
# Allow mDNS
119+
# Allow mDNS from WAN-side too (ON PURPOSE? WHY OUT OF CURIOSITY?)
95120
$IPTABLES -A INPUT -p udp --dport 5353 -j ACCEPT
96121

97-
#when run as gateway
98-
$IPTABLES -A INPUT -p tcp --dport $ssh_port -m state --state NEW -i $wan -j ACCEPT
122+
#if [ "$wan" != "none" ] && [ "$network_mode" != "Appliance" ]; then
123+
if [ "$wan" != "none" ]; then
99124

100-
if [ "$gui_wan" == "True" ]; then
101-
$IPTABLES -A INPUT -p tcp --dport $gui_port -m state --state NEW -i $wan -j ACCEPT
102-
fi
125+
# 1 = ssh only
126+
if [ "$ports_externally_visible" -ge 1 ]; then
127+
$IPTABLES -A INPUT -p tcp --dport $ssh_port -m state --state NEW -i $wan -j ACCEPT
128+
fi
129+
130+
# 2 = ssh + http-or-https (for Admin Console's box.lan/admin too)
131+
if [ "$ports_externally_visible" -ge 2 ]; then
132+
# For now this is implemented using Admin Console variable "gui_port" from:
133+
# https://github.com/iiab/iiab/blob/master/roles/0-init/tasks/main.yml#L87-L95
134+
$IPTABLES -A INPUT -p tcp --dport $gui_port -m state --state NEW -i $wan -j ACCEPT
135+
fi
103136

104-
if [ "$services_externally_visible" == "True" ]; then
105-
$IPTABLES -A INPUT -p tcp --dport $kiwix_port -m state --state NEW -i $wan -j ACCEPT
106-
$IPTABLES -A INPUT -p tcp --dport $kalite_server_port -m state --state NEW -i $wan -j ACCEPT
107-
$IPTABLES -A INPUT -p tcp --dport $kolibri_http_port -m state --state NEW -i $wan -j ACCEPT
108-
$IPTABLES -A INPUT -p tcp --dport $calibre_port -m state --state NEW -i $wan -j ACCEPT
109-
$IPTABLES -A INPUT -p tcp --dport $calibreweb_port -m state --state NEW -i $wan -j ACCEPT
110-
$IPTABLES -A INPUT -p tcp --dport $cups_port -m state --state NEW -i $wan -j ACCEPT
111-
$IPTABLES -A INPUT -p tcp --dport $sugarizer_port -m state --state NEW -i $wan -j ACCEPT
112-
$IPTABLES -A INPUT -p tcp --dport $nodered_port -m state --state NEW -i $wan -j ACCEPT
113-
$IPTABLES -A INPUT -p tcp --dport $mosquitto_port -m state --state NEW -i $wan -j ACCEPT
114-
$IPTABLES -A INPUT -p tcp --dport $transmission_http_port -m state --state NEW -i $wan -j ACCEPT
115-
$IPTABLES -A INPUT -p tcp --dport $transmission_peer_port -m state --state NEW -i $wan -j ACCEPT
116-
$IPTABLES -A INPUT -p udp --dport $minetest_port -m state --state NEW -i $wan -j ACCEPT
117-
118-
if [ "$pbx_enabled" == "True" ]; then
119-
$IPTABLES -A INPUT -p udp --dport $pbx_signaling_ports_chan_sip -m state --state NEW -i $wan -j ACCEPT
120-
$IPTABLES -A INPUT -p udp --dport $pbx_signaling_ports_chan_pjsip -m state --state NEW -i $wan -j ACCEPT
121-
$IPTABLES -A INPUT -p udp --dport $pbx_data_ports -m state --state NEW -i $wan -j ACCEPT
137+
# 3 = ssh + http-or-https + common IIAB services
138+
if [ "$ports_externally_visible" -ge 3 ]; then
139+
$IPTABLES -A INPUT -p tcp --dport $calibre_port -m state --state NEW -i $wan -j ACCEPT
140+
$IPTABLES -A INPUT -p tcp --dport $calibreweb_port -m state --state NEW -i $wan -j ACCEPT
141+
$IPTABLES -A INPUT -p tcp --dport $cups_port -m state --state NEW -i $wan -j ACCEPT
142+
$IPTABLES -A INPUT -p tcp --dport $kalite_server_port -m state --state NEW -i $wan -j ACCEPT
143+
$IPTABLES -A INPUT -p tcp --dport $kiwix_port -m state --state NEW -i $wan -j ACCEPT
144+
$IPTABLES -A INPUT -p tcp --dport $kolibri_http_port -m state --state NEW -i $wan -j ACCEPT
145+
$IPTABLES -A INPUT -p udp --dport $minetest_port -m state --state NEW -i $wan -j ACCEPT
146+
$IPTABLES -A INPUT -p tcp --dport $mosquitto_port -m state --state NEW -i $wan -j ACCEPT
147+
$IPTABLES -A INPUT -p tcp --dport $nodered_port -m state --state NEW -i $wan -j ACCEPT
148+
149+
if [ "$pbx_enabled" == "True" ]; then
150+
$IPTABLES -A INPUT -p udp --dport $pbx_signaling_ports_chan_sip -m state --state NEW -i $wan -j ACCEPT
151+
$IPTABLES -A INPUT -p udp --dport $pbx_signaling_ports_chan_pjsip -m state --state NEW -i $wan -j ACCEPT
152+
$IPTABLES -A INPUT -p udp --dport $pbx_data_ports -m state --state NEW -i $wan -j ACCEPT
153+
fi
154+
155+
$IPTABLES -A INPUT -p tcp --dport $sugarizer_port -m state --state NEW -i $wan -j ACCEPT
156+
$IPTABLES -A INPUT -p tcp --dport $transmission_http_port -m state --state NEW -i $wan -j ACCEPT
157+
$IPTABLES -A INPUT -p tcp --dport $transmission_peer_port -m state --state NEW -i $wan -j ACCEPT
122158
fi
123159

124-
if [ "$samba_enabled" == "True" ]; then
160+
# 4 = ssh + http-or-https + common IIAB services + Samba
161+
if [ "$ports_externally_visible" -ge 4 ]; then
125162
$IPTABLES -A INPUT -p udp --dport $samba_udp_ports -m state --state NEW -i $wan -j ACCEPT
126163
$IPTABLES -A INPUT -p tcp -m multiport --dports $samba_tcp_mports -m state --state NEW -i $wan -j ACCEPT
127164
fi
128-
fi
129165

130-
if [ "$iiab_gateway_enabled" == "True" ]; then
131-
$IPTABLES -A POSTROUTING -t nat -o $wan -j MASQUERADE
132-
fi
166+
# Typically False, to keep client machines (e.g. students) off the Internet
167+
if [ "$iiab_gateway_enabled" == "True" ] && [ "$lan" == "none" ]; then
168+
$IPTABLES -A POSTROUTING -t nat -o $wan -j MASQUERADE
169+
fi
133170

134-
$IPTABLES -A FORWARD -i $wan -o $lan -m state --state ESTABLISHED,RELATED -j ACCEPT
171+
# 3 or 4 IP forwarding rules
172+
$IPTABLES -A FORWARD -i $wan -o $lan -m state --state ESTABLISHED,RELATED -j ACCEPT
173+
# Block https traffic except if directed at server
174+
if [ "$gw_block_https" == "True" ]; then
175+
$IPTABLES -A FORWARD -p tcp ! -d {{ lan_ip }} --dport 443 -j DROP
176+
fi
177+
# Allow outgoing connections from the LAN side
178+
$IPTABLES -A FORWARD -i $lan -o $wan -j ACCEPT
179+
# Don't forward from the outside to the inside
180+
$IPTABLES -A FORWARD -i $wan -o $lan -j DROP
181+
# Enable routing (kernel IP forwarding)
182+
echo 1 > /proc/sys/net/ipv4/ip_forward
183+
184+
# 5 = "all but databases"
185+
if [ "$ports_externally_visible" -lt 5 ]; then
186+
# Drop everything else arriving via WAN
187+
$IPTABLES -A INPUT -i $wan -j DROP
188+
fi
135189

136-
#Block https traffic except if directed at server
137-
if [ "$gw_block_https" == "True" ]; then
138-
$IPTABLES -A FORWARD -p tcp ! -d {{ lan_ip }} --dport 443 -j DROP
139190
fi
140191

141-
# Allow outgoing connections from the LAN side.
142-
$IPTABLES -A FORWARD -i $lan -o $wan -j ACCEPT
143-
144-
# Don't forward from the outside to the inside.
145-
$IPTABLES -A FORWARD -i $wan -o $lan -j DROP
146-
$IPTABLES -A INPUT -i $wan -j DROP
147-
192+
# TCP & UDP block of DNS port 53 if truly nec
148193
if [ "$block_DNS" == "True" ]; then
149194
$IPTABLES -t nat -A PREROUTING -i $lan -p tcp --dport 53 ! -d {{ lan_ip }} -j DNAT --to {{ lan_ip }}:53
150195
$IPTABLES -t nat -A PREROUTING -i $lan -p udp --dport 53 ! -d {{ lan_ip }} -j DNAT --to {{ lan_ip }}:53
151196
fi
152197

198+
# If Squid enabled, as indicated by "HTTPCACHE_ON=True" in /etc/iiab/iiab.env
153199
if [ "$HTTPCACHE_ON" == "True" ]; then
154-
$IPTABLES -t nat -A PREROUTING -i $lan -p tcp --dport 80 ! -d {{ lan_ip }} -j DNAT --to {{ lan_ip }}:3128
200+
$IPTABLES -t nat -A PREROUTING -i $lan -p tcp --dport 80 ! -d {{ lan_ip }} -j DNAT --to {{ lan_ip }}:3128
155201
fi
156202

157-
# Enable routing.
158-
echo 1 > /proc/sys/net/ipv4/ip_forward
159-
# save the whole rule set now
203+
# Save the whole rule set
160204
{% if is_debuntu %}
161205
netfilter-persistent save
162206
{% else %}
163207
iptables-save > $IPTABLES_DATA
164208
{% endif %}
209+
165210
exit 0

‎vars/default_vars.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,20 @@ gui_wan: True
9191
adm_cons_force_ssl: False
9292
adm_cons_allow_downloads: False
9393

94-
# Enables "campus access" to kiwix (3000), kalite (8008) & calibre (8010 or
95-
# 8080) on WAN side of server. See network/templates/gateway/iiab-gen-iptables
96-
# within github.com/iiab/iiab/blob/master/roles/
97-
services_externally_visible: True
94+
# Enable "campus access" to ~10 common IIAB services like Kiwix (3000), KA Lite
95+
# (8008) and Calibre (8010 or 8080) etc, on the WAN side of your IIAB server.
96+
# Only 1 of the 6 lines below should be uncommented:
97+
#
98+
#ports_externally_visible: 0 # none
99+
#ports_externally_visible: 1 # ssh only
100+
#ports_externally_visible: 2 # ssh + Admin Console
101+
ports_externally_visible: 3 # ssh + Admin Console + common IIAB services
102+
#ports_externally_visible: 4 # ssh + Admin Console + common IIAB services + Samba
103+
#ports_externally_visible: 5 # all but databases
104+
#
105+
# Or further customize your iptables firewall by editing:
106+
# /opt/iiab/iiab/roles/network/templates/gateway/iiab-gen-iptables
107+
# And then run: cd /opt/iiab/iiab; ./iiab-network
98108

99109
# Gateway and Filters
100110
# Most all implementations use "iiab_gateway_enabled: False" within

‎vars/local_vars_big.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,20 @@ host_channel: 6
4040
hostapd_secure: False
4141
hostapd_password: changeme
4242

43-
# Enables "campus access" to kiwix (3000), kalite (8008) & calibre (8010 or
44-
# 8080) on WAN side of server. See network/templates/gateway/iiab-gen-iptables
45-
# within github.com/iiab/iiab/blob/master/roles/
46-
services_externally_visible: True
43+
# Enable "campus access" to ~10 common IIAB services like Kiwix (3000), KA Lite
44+
# (8008) and Calibre (8010 or 8080) etc, on the WAN side of your IIAB server.
45+
# Only 1 of the 6 lines below should be uncommented:
46+
#
47+
#ports_externally_visible: 0 # none
48+
#ports_externally_visible: 1 # ssh only
49+
#ports_externally_visible: 2 # ssh + Admin Console
50+
ports_externally_visible: 3 # ssh + Admin Console + common IIAB services
51+
#ports_externally_visible: 4 # ssh + Admin Console + common IIAB services + Samba
52+
#ports_externally_visible: 5 # all but databases
53+
#
54+
# Or further customize your iptables firewall by editing:
55+
# /opt/iiab/iiab/roles/network/templates/gateway/iiab-gen-iptables
56+
# And then run: cd /opt/iiab/iiab; ./iiab-network
4757

4858
# Make this True if client machines should have access to WAN/Internet:
4959
iiab_gateway_enabled: False

0 commit comments

Comments
 (0)