From 50e473127cc4604a05f263bdd2c3cb8c1155f5c4 Mon Sep 17 00:00:00 2001 From: NebulaOnion Date: Sat, 28 Jan 2023 15:20:04 +0000 Subject: [PATCH] Add after.rules njalla ufw file --- njallavps/ufw/after.rules | 44 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 njallavps/ufw/after.rules diff --git a/njallavps/ufw/after.rules b/njallavps/ufw/after.rules new file mode 100644 index 0000000..0c31bda --- /dev/null +++ b/njallavps/ufw/after.rules @@ -0,0 +1,44 @@ +# BEGIN UFW AND DOCKER +*filter +:ufw-user-forward - [0:0] +:ufw-docker-logging-deny - [0:0] +:DOCKER-USER - [0:0] +:ufw-after-input - [0:0] +:ufw-after-output - [0:0] +:ufw-after-forward - [0:0] +:ufw-docker-logging-deny - [0:0] +# End required lines + +# don't log noisy services by default +-A ufw-after-input -p udp --dport 137 -j ufw-skip-to-policy-input +-A ufw-after-input -p udp --dport 138 -j ufw-skip-to-policy-input +-A ufw-after-input -p tcp --dport 139 -j ufw-skip-to-policy-input +-A ufw-after-input -p tcp --dport 445 -j ufw-skip-to-policy-input +-A ufw-after-input -p udp --dport 67 -j ufw-skip-to-policy-input +-A ufw-after-input -p udp --dport 68 -j ufw-skip-to-policy-input + +# don't log noisy broadcast +-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input + +-A DOCKER-USER -j ufw-user-forward + +-A DOCKER-USER -j RETURN -s 10.0.0.0/8 +-A DOCKER-USER -j RETURN -s 172.16.0.0/12 +-A DOCKER-USER -j RETURN -s 192.168.0.0/16 + +-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN + +-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16 +-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8 +-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12 +-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16 +-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8 +-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12 + +-A DOCKER-USER -j RETURN + +-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] " +-A ufw-docker-logging-deny -j DROP + +COMMIT +# END UFW AND DOCKER \ No newline at end of file