184 lines
8.4 KiB
Plaintext
184 lines
8.4 KiB
Plaintext
# -*-mode: conf[Space]; tab-width: 8; coding: utf-8-unix -*-
|
|
# firewall.bash.libvirt.9
|
|
*mangle
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
:LIBVIRT_PRT - [0:0]
|
|
#D#-A INPUT -j LOG --log-prefix "iptables_mangle_END-i: " --log-uid
|
|
-A POSTROUTING -j LIBVIRT_PRT
|
|
COMMIT
|
|
|
|
*nat
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
:LIBVIRT_PRT - [0:0]
|
|
# was ! -o lo - -o wlan4
|
|
# let resolve.conf redirect to lo - this rule cannot be removed
|
|
#-A OUTPUT -o wlan4 -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1:53
|
|
#-A OUTPUT -o wlan4 -p udp --dport 53 -j DNAT --to-destination 127.0.0.1:53
|
|
|
|
# .onion mapped addresses redirection to Tor.
|
|
###-A OUTPUT -d 172.16.0.0/12 -p tcp -j DNAT --to-destination 127.0.0.1:9040
|
|
## Log.
|
|
#D-A INPUT -j LOG --log-prefix "iptables_nat_END-i: " --log-uid
|
|
-A POSTROUTING -j LIBVIRT_PRT
|
|
-A LIBVIRT_PRT -s 10.0.2.0/24 -d 224.0.0.0/24 -j RETURN
|
|
-A LIBVIRT_PRT -s 10.0.2.0/24 -d 255.255.255.255/32 -j RETURN
|
|
-A LIBVIRT_PRT -s 10.0.2.0/24 ! -d 10.0.2.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
|
|
-A LIBVIRT_PRT -s 10.0.2.0/24 ! -d 10.0.2.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
|
|
-A LIBVIRT_PRT -s 10.0.2.0/24 ! -d 10.0.2.0/24 -j MASQUERADE
|
|
COMMIT
|
|
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT DROP [0:0]
|
|
:LIBVIRT_FWI - [0:0]
|
|
:LIBVIRT_FWO - [0:0]
|
|
:LIBVIRT_FWX - [0:0]
|
|
:LIBVIRT_INP - [0:0]
|
|
:LIBVIRT_OUT - [0:0]
|
|
|
|
#D#-A INPUT -j LOG --log-prefix "iptables_filter_BEGIN-i: firewall.conf.new.9" --log-uid
|
|
# blocks
|
|
-A INPUT -i wlan6 -s 5.1.56.52 -p tcp -j DROP
|
|
-A INPUT -i wlan6 -s 5.39.72.2 -p tcp -j DROP
|
|
-A INPUT -i wlan4 -s 37.191.192.147 -p tcp -j DROP
|
|
-A INPUT -i wlan4 -s 51.79.22.224 -p tcp -j DROP
|
|
|
|
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
|
-A INPUT -m state --state INVALID -j DROP
|
|
-A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
|
|
-A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
|
|
-A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
|
|
-A INPUT -f -j DROP
|
|
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP
|
|
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -m state --state ESTABLISHED -j ACCEPT
|
|
### this is required for outgoing pings
|
|
-A INPUT -i wlan4 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-i: " --log-uid
|
|
-A INPUT -i wlan4 -p icmp -j ACCEPT
|
|
|
|
# these are NOT needed
|
|
#!-A INPUT -i wlan4 -m owner --gid-owner 226 -p udp --sport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
|
|
#!-A INPUT -i wlan4 -m owner --gid-owner 226 -p udp --sport 123 -j ACCEPT
|
|
#!-A INPUT -i wlan4 -m owner --uid-owner 0 -p udp --sport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
|
|
#!-A INPUT -i wlan4 -m owner --uid-owner 0 -p udp --sport 123 -j ACCEPT
|
|
# these are NOT needed
|
|
#!-A INPUT -i wlan4 -p tcp -m owner --gid-owner 1 -j ACCEPT
|
|
# these are NOT needed
|
|
#!-A INPUT -i wlan4 -p tcp -m owner --gid-owner 216 -j ACCEPT
|
|
#?# let dhcp through?
|
|
#?-A INPUT -p udp --sport 68 -j ACCEPT
|
|
#?-A INPUT -p udp --sport 67 -j ACCEPT
|
|
-A INPUT -i wlan4 -p udp --sport 137 -j DROP
|
|
-A INPUT -i wlan4 -p udp --sport 138 -j DROP
|
|
-A INPUT -i wlan4 -p udp --sport 139 -j DROP
|
|
### this is required for outgoing pings
|
|
-A INPUT -i virbr1 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-i: " --log-uid
|
|
-A INPUT -i virbr1 -p icmp -j ACCEPT
|
|
#D#-A INPUT -i virbr1 -p tcp --sport 22 -j LOG --log-uid --log-prefix "iptables_22_ACCEPT-i: "
|
|
-A INPUT -i virbr1 -p tcp --sport 22 -j ACCEPT
|
|
#D#-A INPUT -i virbr1 -p tcp --sport 9128 -j LOG --log-uid --log-prefix "iptables_9128_ACCEPT-i: "
|
|
-A INPUT -i virbr1 -p tcp --sport 9128 -j ACCEPT
|
|
#D#-A INPUT -i virbr1 -p tcp --sport 9050 -j LOG --log-uid --log-prefix "iptables_9050_ACCEPT-i: "
|
|
-A INPUT -i virbr1 -p tcp --sport 9050 -j ACCEPT
|
|
#D#-A INPUT -i virbr1 -p tcp --sport 7001 -j LOG --log-uid --log-prefix "iptables_7001_ACCEPT-i: "
|
|
-A INPUT -i virbr1 -p tcp --sport 7001 -j ACCEPT
|
|
#D#-A INPUT -i virbr1 -p udp --sport 9053 -j LOG --log-uid --log-prefix "iptables_9053_ACCEPT-i: "
|
|
-A INPUT -i virbr1 -p udp --sport 9053 -j ACCEPT
|
|
#D#-A INPUT -j LOG --log-prefix "IPTABLES_filter_DROP-i: " --log-uid
|
|
#D#-A INPUT -j DROP
|
|
-A INPUT -j LIBVIRT_INP
|
|
|
|
-A FORWARD -j LIBVIRT_FWX
|
|
-A FORWARD -j LIBVIRT_FWI
|
|
-A FORWARD -j LIBVIRT_FWO
|
|
-A OUTPUT -o lo -j ACCEPT
|
|
-A OUTPUT -m state --state ESTABLISHED -j ACCEPT
|
|
#D#-A OUTPUT -o wlan4 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-o: " --log-uid
|
|
-A OUTPUT -o wlan4 -p icmp -j ACCEPT
|
|
#?-A OUTPUT -d 10.16.238.81/24 -j ACCEPT
|
|
#?-A OUTPUT -d 10.152.152.0/24 -j ACCEPT
|
|
#?-A OUTPUT -d 10.0.2.0/24 -j ACCEPT
|
|
|
|
# The ntp user is allowed to connect to services listening on the ntp port...
|
|
# If root runs ntpdate manually you will see requests to port 53 UID=0
|
|
#D#-A OUTPUT -o wlan4 -m owner --gid-owner 226 -p udp --dport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
|
|
-A OUTPUT -o wlan4 -m owner --gid-owner 226 -p udp --dport 123 -j ACCEPT
|
|
#D#-A OUTPUT -o wlan4 -m owner --uid-owner 0 -p udp --dport 123 -j LOG --log-uid --log-prefix "iptables_123_ACCEPT-o: "
|
|
-A OUTPUT -o wlan4 -m owner --uid-owner 0 -p udp --dport 123 -j ACCEPT
|
|
# ssh - specifically forbid ssh out the wlan
|
|
-A OUTPUT -o wlan4 -p tcp --dport 22 -j LOG --log-uid --log-prefix "IPTABLES_ssh_REJECT-o: "
|
|
-A OUTPUT -o wlan4 -p tcp --dport 22 -j REJECT --reject-with icmp-port-unreachable
|
|
-A OUTPUT -o wlan4 -m owner --gid-owner 1 -j ACCEPT
|
|
# necessary and sufficient
|
|
-A OUTPUT -o wlan4 -m owner --gid-owner 216 -j ACCEPT
|
|
#D#-A OUTPUT -o virbr1 -p icmp -j LOG --log-prefix "iptables_icmp_ACCEPT-o: " --log-uid
|
|
-A OUTPUT -o virbr1 -p icmp -j ACCEPT
|
|
#D#-A OUTPUT -o virbr1 -p tcp --dport 22 -j LOG --log-uid --log-prefix "iptables_22_ACCEPT-o: "
|
|
-A OUTPUT -o virbr1 -p tcp --dport 22 -j ACCEPT
|
|
#D#-A OUTPUT -o virbr1 -p tcp --dport 9128 -j LOG --log-uid --log-prefix "iptables_9128_ACCEPT-o: "
|
|
-A OUTPUT -o virbr1 -p tcp --dport 9128 -j ACCEPT
|
|
#D#-A OUTPUT -o virbr1 -p tcp --dport 9050 -j LOG --log-uid --log-prefix "iptables_9050_ACCEPT-o: "
|
|
-A OUTPUT -o virbr1 -p tcp --dport 9050 -j ACCEPT
|
|
#D#-A OUTPUT -o virbr1 -p tcp --dport 7001 -j LOG --log-uid --log-prefix "iptables_7001_ACCEPT-o: "
|
|
-A OUTPUT -o virbr1 -p tcp --dport 7001 -j ACCEPT
|
|
#D#-A OUTPUT -o virbr1 -p udp --dport 9053 -j LOG --log-uid --log-prefix "iptables_9053_ACCEPT-o: "
|
|
-A OUTPUT -o virbr1 -p udp --dport 9053 -j ACCEPT
|
|
#??-A OUTPUT -p udp -m udp --sport 68 --dport 67 -j RETURN
|
|
#?-A OUTPUT -p udp -m udp --sport 68 --dport 67 -j ACCEPT
|
|
-A OUTPUT -j LIBVIRT_OUT
|
|
-A LIBVIRT_FWI -o virbr1 -j LOG --log-uid --log-prefix "IPTABLES_FWI_REJECT-o: "
|
|
-A LIBVIRT_FWI -o virbr2 -j REJECT --reject-with icmp-port-unreachable
|
|
|
|
-A LIBVIRT_FWI -d 10.0.2.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
-A LIBVIRT_FWI -o virbr1 -j LOG --log-uid --log-prefix "IPTABLES_FWI_REJECT-o: "
|
|
-A LIBVIRT_FWI -o virbr1 -j REJECT --reject-with icmp-port-unreachable
|
|
|
|
-A LIBVIRT_FWO -i virbr2 -j LOG --log-uid --log-prefix "IPTABLES_FWO_REJECT-i: "
|
|
-A LIBVIRT_FWO -i virbr2 -j REJECT --reject-with icmp-port-unreachable
|
|
|
|
-A LIBVIRT_FWO -s 10.0.2.0/24 -i virbr1 -j ACCEPT
|
|
|
|
-A LIBVIRT_FWO -i virbr1 -j LOG --log-uid --log-prefix "IPTABLES_FWO_REJECT-i: "
|
|
-A LIBVIRT_FWO -i virbr1 -j REJECT --reject-with icmp-port-unreachable
|
|
|
|
-A LIBVIRT_FWX -i virbr2 -o virbr2 -j ACCEPT
|
|
-A LIBVIRT_FWX -i virbr1 -o virbr1 -j ACCEPT
|
|
|
|
# FixMe: sic this is what libvirt did -i --dport
|
|
# FixMe: I will disable them as I dont think theyre needed or wanted
|
|
#no -A LIBVIRT_INP -i virbr2 -p udp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_INP -i virbr2 -p tcp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_INP -i virbr2 -p udp --dport 67 -j ACCEPT
|
|
#no -A LIBVIRT_INP -i virbr2 -p tcp --dport 67 -j ACCEPT
|
|
#no
|
|
#no # FixMe:sic this is what libvirt did -i --dport
|
|
#no -A LIBVIRT_INP -i virbr1 -p udp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_INP -i virbr1 -p tcp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_INP -i virbr1 -p udp --dport 67 -j ACCEPT
|
|
#no -A LIBVIRT_INP -i virbr1 -p tcp --dport 67 -j ACCEPT
|
|
#no
|
|
#no -A LIBVIRT_OUT -o virbr2 -p udp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_OUT -o virbr2 -p tcp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_OUT -o virbr2 -p udp --dport 68 -j ACCEPT
|
|
#no -A LIBVIRT_OUT -o virbr2 -p tcp --dport 68 -j ACCEPT
|
|
#no
|
|
#no -A LIBVIRT_OUT -o virbr1 -p udp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_OUT -o virbr1 -p tcp --dport 53 -j ACCEPT
|
|
#no -A LIBVIRT_OUT -o virbr1 -p udp --dport 68 -j ACCEPT
|
|
#no -A LIBVIRT_OUT -o virbr1 -p tcp --dport 68 -j ACCEPT
|
|
-A OUTPUT -j LOG --log-uid --log-prefix "IPTABLES_filter_DROP-o: "
|
|
#D#-A OUTPUT -j DROP
|
|
COMMIT
|
|
# Generated Mon 23 Nov 2020 10:02:17 PM UTC
|
|
# Whonix firewall for wlan=wlan4 IP=10.16.238.81 NET=10.16.238.81/24 LIBVIRT_FW=1
|