InfraRefresh/firewall

From NURDspace

Groups

group {
    address-group NURD-subnets {
        address 172.31.0.0/16
        address 192.168.1.0/24
        address 192.168.2.0/24
        address 10.208.0.0/16
    }
    address-group SpaceVPN-BGP {
        address 172.31.250.2
        address 192.168.21.1
    }
    address-group techinc-filers {
        address 10.0.21.68
        address 10.0.21.69
        address 10.0.21.72
        address 10.0.21.73
        address 10.0.20.0/24
        address 10.209.50.16
        address 10.209.60.22
        address 10.209.50.1
        address 10.209.50.2
    }
    ipv6-address-group drop-group {
        ipv6-address 2001:470:7a9c:31::11
        ipv6-address 2001:470:7a9c:31::10
        ipv6-address 2001:470:7a9c:1337::222
        ipv6-address 2001:470:7a9c:1337::221
    }
    network-group RFC1918 {
        network 172.16.0.0/12
        network 10.0.0.0/8
        network 192.168.0.0/16
    }
}


UPC Forward Chain

name upc-in {
    default-action drop
    rule 1 {
        action accept
        description "Accept related"
        state {
            related enable
        }
    }
    rule 2 {
        action accept
        description "Accept established"
        state {
            established enable
        }
    }
    rule 4 {
        action accept
        description "Allow icmp"
        icmp {
            type-name any
        }
        protocol icmp
    }
    rule 5 {
        action accept
        description "HE Tunnel endpoint"
        source {
            address 216.66.84.46
        }
    }
    rule 6 {
        action accept
        description "Openvpn inbound"
        destination {
            port 1194
        }
        protocol udp
    }
    rule 7 {
        action accept
        description "Rev proxy"
        destination {
            port 80
        }
        protocol tcp
    }
    rule 8 {
        action accept
        description "Rev proxy"
        destination {
            port 443
        }
        protocol tcp
    }
    rule 9 {
        action accept
        description "SSH Gitlab"
        destination {
            port 22
        }
        protocol tcp
    }
    rule 10 {
        action accept
        description IKE
        protocol 50
    }
    rule 11 {
        action accept
        destination {
            port 500
        }
        protocol udp
    }
    rule 13 {
        action accept
        description "port 122 ssh to tankstation"
        destination {
            port 122
        }
        protocol tcp
    }
    rule 14 {
        action accept
        description "mosh tankstation"
        destination {
            port 60000-60050
        }
        protocol udp
    }
}

UPC Input chain

name upc-local {
    default-action drop
    rule 1 {
        action accept
        description "Allow Established"
        log disable
        state {
            established enable
        }
    }
    rule 2 {
        action accept
        description "Allow Related"
        log disable
        state {
            related enable
        }
    }
    rule 3 {
        action accept
        description "Allow dhcp"
        destination {
            port 67,68
        }
        log disable
        protocol udp
    }
    rule 4 {
        action accept
        description "Allow dns"
        destination {
            port 53
        }
        log disable
        protocol tcp_udp
    }
    rule 5 {
        action accept
        description "Allow ntp"
        destination {
            port 123
        }
        limit {
            burst 1
            rate 5/second
        }
        log enable
        protocol udp
    }
    rule 6 {
        action accept
        description "Allow ICMP"
        limit {
            burst 1
            rate 5/second
        }
        protocol icmp
    }
    rule 7 {
        action accept
        description "Zarya - home.gigafreak.net"
        source {
            address 84.245.27.185
        }
    }
    rule 8 {
        action accept
        description "HE Tunnel endpoint"
        source {
            address 216.66.84.46
        }
    }
    rule 9 {
        action accept
        description "Openvpn inbound"
        destination {
            port 1194
        }
        protocol udp
    }
    rule 11 {
        action accept
        description "Openvpn Skillz"
        destination {
            port 1192
        }
        protocol udp
    }
}

Space VPN Forward chain

name spacevpn-in {
    default-action drop
    rule 1 {
        action accept
        state {
            established enable
        }
    }
    rule 2 {
        action accept
        state {
            related enable
        }
    }
    rule 5 {
        action accept
        description icmp
        protocol icmp
    }
    rule 6 {
        action accept
        description ipam.nurd.space
        destination {
            address 10.208.10.42
            port 80,443
        }
        protocol tcp
    }
    rule 9 {
        action accept
        description BGP
        destination {
            port 179
        }
        protocol tcp
        source {
            group {
                address-group SpaceVPN-BGP
            }
        }
    }
    rule 10 {
        action accept
        description "ipam dns"
        destination {
            address 10.208.10.42
            port 53
        }
        protocol tcp_udp
    }
    rule 11 {
        action accept
        description backup01
        destination {
            address 10.208.10.7
        }
        protocol all
    }
    rule 13 {
        action accept
        description Bacula
        destination {
            port 9102
        }
        protocol tcp
    }
    rule 14 {
        action accept
        description Ansible.ti
        protocol all
        source {
            address 10.209.60.22
        }
    }
    rule 17 {
        action accept
        description resolver
        destination {
            address 192.168.1.2
            port 53
        }
        protocol tcp_udp
    }
    rule 9990 {
        action drop
        description "block local"
        destination {
            group {
                address-group NURD-subnets
            }
        }
    }
    rule 9999 {
        action accept
    }
}