56 lines
1.2 KiB
Django/Jinja
56 lines
1.2 KiB
Django/Jinja
# Managed by Ansible — do not edit manually
|
|
|
|
*filter
|
|
|
|
:INPUT DROP [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:DOCKER-USER - [0:0]
|
|
|
|
|
|
# --- INPUT ---
|
|
|
|
# Allow loopback
|
|
-A INPUT -i lo -j ACCEPT
|
|
|
|
# Allow established/related connections
|
|
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Allow SSH
|
|
-A INPUT -p tcp --dport {{ firewall_ssh_port }} -j ACCEPT
|
|
|
|
# Allow additional host ports
|
|
{% for port in firewall_allowed_tcp_ports %}
|
|
-A INPUT -p tcp --dport {{ port }} -j ACCEPT
|
|
{% endfor %}
|
|
{% for port in firewall_allowed_udp_ports %}
|
|
-A INPUT -p udp --dport {{ port }} -j ACCEPT
|
|
{% endfor %}
|
|
|
|
|
|
# --- DOCKER-USER ---
|
|
|
|
# Allow loopback
|
|
-A DOCKER-USER -i lo -j RETURN
|
|
|
|
# Allow outgoing from Docker IP range
|
|
-A DOCKER-USER -s 172.16.0.0/12 -j RETURN
|
|
|
|
# Whitelist specific TCP ports to containers
|
|
{% for port in docker_user_allowed_tcp_ports %}
|
|
-A DOCKER-USER -p tcp --dport {{ port }} -j RETURN
|
|
{% endfor %}
|
|
|
|
# Whitelist specific UDP ports to containers
|
|
{% for port in docker_user_allowed_udp_ports %}
|
|
-A DOCKER-USER -p udp --dport {{ port }} -j RETURN
|
|
{% endfor %}
|
|
|
|
# Allow all already established connections
|
|
-A DOCKER-USER -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
|
|
|
|
# Drop everything else to containers
|
|
-A DOCKER-USER -j DROP
|
|
|
|
COMMIT
|