mirror of
https://git.anonymousland.org/anonymousland/infrastructure.git
synced 2024-07-01 03:31:19 +00:00
Add after.rules njalla ufw file
This commit is contained in:
parent
b75c6cfe2c
commit
50e473127c
44
njallavps/ufw/after.rules
Normal file
44
njallavps/ufw/after.rules
Normal file
|
@ -0,0 +1,44 @@
|
||||||
|
# BEGIN UFW AND DOCKER
|
||||||
|
*filter
|
||||||
|
:ufw-user-forward - [0:0]
|
||||||
|
:ufw-docker-logging-deny - [0:0]
|
||||||
|
:DOCKER-USER - [0:0]
|
||||||
|
:ufw-after-input - [0:0]
|
||||||
|
:ufw-after-output - [0:0]
|
||||||
|
:ufw-after-forward - [0:0]
|
||||||
|
:ufw-docker-logging-deny - [0:0]
|
||||||
|
# End required lines
|
||||||
|
|
||||||
|
# don't log noisy services by default
|
||||||
|
-A ufw-after-input -p udp --dport 137 -j ufw-skip-to-policy-input
|
||||||
|
-A ufw-after-input -p udp --dport 138 -j ufw-skip-to-policy-input
|
||||||
|
-A ufw-after-input -p tcp --dport 139 -j ufw-skip-to-policy-input
|
||||||
|
-A ufw-after-input -p tcp --dport 445 -j ufw-skip-to-policy-input
|
||||||
|
-A ufw-after-input -p udp --dport 67 -j ufw-skip-to-policy-input
|
||||||
|
-A ufw-after-input -p udp --dport 68 -j ufw-skip-to-policy-input
|
||||||
|
|
||||||
|
# don't log noisy broadcast
|
||||||
|
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
|
||||||
|
|
||||||
|
-A DOCKER-USER -j ufw-user-forward
|
||||||
|
|
||||||
|
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
|
||||||
|
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
|
||||||
|
-A DOCKER-USER -j RETURN -s 192.168.0.0/16
|
||||||
|
|
||||||
|
-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN
|
||||||
|
|
||||||
|
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
|
||||||
|
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
|
||||||
|
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
|
||||||
|
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
|
||||||
|
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
|
||||||
|
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12
|
||||||
|
|
||||||
|
-A DOCKER-USER -j RETURN
|
||||||
|
|
||||||
|
-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
|
||||||
|
-A ufw-docker-logging-deny -j DROP
|
||||||
|
|
||||||
|
COMMIT
|
||||||
|
# END UFW AND DOCKER
|
Loading…
Reference in New Issue
Block a user