Initial commit

2026-03-24 08:19:29 +01:00
commit 2b1ca2d5be
95 changed files with 1993 additions and 0 deletions
@@ -0,0 +1,55 @@
+# Managed by Ansible — do not edit manually
+
+*filter
+
+:INPUT DROP [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER-USER - [0:0]
+
+
+# --- INPUT ---
+
+# Allow loopback
+-A INPUT -i lo -j ACCEPT
+
+# Allow established/related connections
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# Allow SSH
+-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT
+
+# Allow additional host ports
+{% for port in firewall_allowed_tcp_ports %}
+-A INPUT -p tcp --dport {{ port }} -j ACCEPT
+{% endfor %}
+{% for port in firewall_allowed_udp_ports %}
+-A INPUT -p udp --dport {{ port }} -j ACCEPT
+{% endfor %}
+
+
+# --- DOCKER-USER ---
+
+# Allow loopback
+-A DOCKER-USER -i lo -j RETURN
+
+# Allow outgoing from Docker IP range
+-A DOCKER-USER -s 172.16.0.0/12 -j RETURN
+
+# Whitelist specific TCP ports to containers
+{% for port in docker_user_allowed_tcp_ports %}
+-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN
+{% endfor %}
+
+# Whitelist specific UDP ports to containers
+{% for port in docker_user_allowed_udp_ports %}
+-A DOCKER-USER -p udp --dport {{ port }} -j RETURN
+{% endfor %}
+
+# Allow all already established connections
+-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
+
+# Drop everything else to containers
+-A DOCKER-USER -j DROP
+
+COMMIT