From 3da72a751fe54369d6dda9c6746eb888d128302a Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Tue, 16 Jul 2019 19:55:12 +0200 Subject: ch-router: make firewall script a little bit nicer --- inventory/host_vars/ch-router.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'inventory/host_vars') diff --git a/inventory/host_vars/ch-router.yml b/inventory/host_vars/ch-router.yml index 5394c4d6..fe313d87 100644 --- a/inventory/host_vars/ch-router.yml +++ b/inventory/host_vars/ch-router.yml @@ -66,7 +66,7 @@ openwrt_mixin: SSH_PORT=$(uci get dropbear.@dropbear[0].Port) - ## Local Traffic + ## Local/Management Traffic # iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT @@ -84,11 +84,13 @@ openwrt_mixin: ## LAN Traffic # - iptables -A INPUT -i "$SVC_IF" -p icmp -d "$SVC_IPADDR" -s 192.168.0.0/16 -j ACCEPT - iptables -A INPUT -i "$SVC_IF" -d "$SVC_IPADDR" -p tcp --dport "$SSH_PORT" -j ACCEPT + iptables -A INPUT -i "$SVC_IF" -d "$SVC_IPADDR" -s 192.168.0.0/16 -p icmp -j ACCEPT + iptables -A INPUT -i "$SVC_IF" -d "$SVC_IPADDR" -s 192.168.0.0/16 -p tcp --dport "$SSH_PORT" -j ACCEPT iptables -A INPUT -i "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + iptables -A FORWARD -i "$SVC_IF" -o "$MAGENTA_IF" -s 192.168.0.0/16 -j ACCEPT iptables -A FORWARD -i "$MAGENTA_IF" -o "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + iptables -t nat -A POSTROUTING -o "$MAGENTA_IF" -s 192.168.0.0/16 -j SNAT --to "$MAGENTA_IPADDR" -- cgit v1.2.3