<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://nurdspace.nl/index.php?action=history&amp;feed=atom&amp;title=InfraRefresh%2Ffirewall</id>
	<title>InfraRefresh/firewall - Revision history</title>
	<link rel="self" type="application/atom+xml" href="https://nurdspace.nl/index.php?action=history&amp;feed=atom&amp;title=InfraRefresh%2Ffirewall"/>
	<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=InfraRefresh/firewall&amp;action=history"/>
	<updated>2026-04-19T07:43:58Z</updated>
	<subtitle>Revision history for this page on the wiki</subtitle>
	<generator>MediaWiki 1.39.4</generator>
	<entry>
		<id>https://nurdspace.nl/index.php?title=InfraRefresh/firewall&amp;diff=8289&amp;oldid=prev</id>
		<title>Zarya: Created page with &quot;== Groups ==  group {      address-group NURD-subnets {          address 172.31.0.0/16          address 192.168.1.0/24          address 192.168.2.0/24          address 10.208....&quot;</title>
		<link rel="alternate" type="text/html" href="https://nurdspace.nl/index.php?title=InfraRefresh/firewall&amp;diff=8289&amp;oldid=prev"/>
		<updated>2017-11-23T11:09:43Z</updated>

		<summary type="html">&lt;p&gt;Created page with &amp;quot;== Groups ==  group {      address-group NURD-subnets {          address 172.31.0.0/16          address 192.168.1.0/24          address 192.168.2.0/24          address 10.208....&amp;quot;&lt;/p&gt;
&lt;p&gt;&lt;b&gt;New page&lt;/b&gt;&lt;/p&gt;&lt;div&gt;== Groups ==&lt;br /&gt;
 group {&lt;br /&gt;
     address-group NURD-subnets {&lt;br /&gt;
         address 172.31.0.0/16&lt;br /&gt;
         address 192.168.1.0/24&lt;br /&gt;
         address 192.168.2.0/24&lt;br /&gt;
         address 10.208.0.0/16&lt;br /&gt;
     }&lt;br /&gt;
     address-group SpaceVPN-BGP {&lt;br /&gt;
         address 172.31.250.2&lt;br /&gt;
         address 192.168.21.1&lt;br /&gt;
     }&lt;br /&gt;
     address-group techinc-filers {&lt;br /&gt;
         address 10.0.21.68&lt;br /&gt;
         address 10.0.21.69&lt;br /&gt;
         address 10.0.21.72&lt;br /&gt;
         address 10.0.21.73&lt;br /&gt;
         address 10.0.20.0/24&lt;br /&gt;
         address 10.209.50.16&lt;br /&gt;
         address 10.209.60.22&lt;br /&gt;
         address 10.209.50.1&lt;br /&gt;
         address 10.209.50.2&lt;br /&gt;
     }&lt;br /&gt;
     ipv6-address-group drop-group {&lt;br /&gt;
         ipv6-address 2001:470:7a9c:31::11&lt;br /&gt;
         ipv6-address 2001:470:7a9c:31::10&lt;br /&gt;
         ipv6-address 2001:470:7a9c:1337::222&lt;br /&gt;
         ipv6-address 2001:470:7a9c:1337::221&lt;br /&gt;
     }&lt;br /&gt;
     network-group RFC1918 {&lt;br /&gt;
         network 172.16.0.0/12&lt;br /&gt;
         network 10.0.0.0/8&lt;br /&gt;
         network 192.168.0.0/16&lt;br /&gt;
     }&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== UPC Forward Chain ==&lt;br /&gt;
 name upc-in {&lt;br /&gt;
     default-action drop&lt;br /&gt;
     rule 1 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Accept related&amp;quot;&lt;br /&gt;
         state {&lt;br /&gt;
             related enable&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 2 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Accept established&amp;quot;&lt;br /&gt;
         state {&lt;br /&gt;
             established enable&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 4 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow icmp&amp;quot;&lt;br /&gt;
         icmp {&lt;br /&gt;
             type-name any&lt;br /&gt;
         }&lt;br /&gt;
         protocol icmp&lt;br /&gt;
     }&lt;br /&gt;
     rule 5 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;HE Tunnel endpoint&amp;quot;&lt;br /&gt;
         source {&lt;br /&gt;
             address 216.66.84.46&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 6 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Openvpn inbound&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 1194&lt;br /&gt;
         }&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 7 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Rev proxy&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 80&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
     }&lt;br /&gt;
     rule 8 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Rev proxy&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 443&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
     }&lt;br /&gt;
     rule 9 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;SSH Gitlab&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 22&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
     }&lt;br /&gt;
     rule 10 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description IKE&lt;br /&gt;
         protocol 50&lt;br /&gt;
     }&lt;br /&gt;
     rule 11 {&lt;br /&gt;
         action accept&lt;br /&gt;
         destination {&lt;br /&gt;
             port 500&lt;br /&gt;
         }&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 13 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;port 122 ssh to tankstation&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 122&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
     }&lt;br /&gt;
     rule 14 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;mosh tankstation&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 60000-60050&lt;br /&gt;
         }&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
 }&lt;br /&gt;
== UPC Input chain ==&lt;br /&gt;
 name upc-local {&lt;br /&gt;
     default-action drop&lt;br /&gt;
     rule 1 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow Established&amp;quot;&lt;br /&gt;
         log disable&lt;br /&gt;
         state {&lt;br /&gt;
             established enable&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 2 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow Related&amp;quot;&lt;br /&gt;
         log disable&lt;br /&gt;
         state {&lt;br /&gt;
             related enable&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 3 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow dhcp&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 67,68&lt;br /&gt;
         }&lt;br /&gt;
         log disable&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 4 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow dns&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 53&lt;br /&gt;
         }&lt;br /&gt;
         log disable&lt;br /&gt;
         protocol tcp_udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 5 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow ntp&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 123&lt;br /&gt;
         }&lt;br /&gt;
         limit {&lt;br /&gt;
             burst 1&lt;br /&gt;
             rate 5/second&lt;br /&gt;
         }&lt;br /&gt;
         log enable&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 6 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Allow ICMP&amp;quot;&lt;br /&gt;
         limit {&lt;br /&gt;
             burst 1&lt;br /&gt;
             rate 5/second&lt;br /&gt;
         }&lt;br /&gt;
         protocol icmp&lt;br /&gt;
     }&lt;br /&gt;
     rule 7 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Zarya - home.gigafreak.net&amp;quot;&lt;br /&gt;
         source {&lt;br /&gt;
             address 84.245.27.185&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 8 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;HE Tunnel endpoint&amp;quot;&lt;br /&gt;
         source {&lt;br /&gt;
             address 216.66.84.46&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 9 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Openvpn inbound&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 1194&lt;br /&gt;
         }&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 11 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;Openvpn Skillz&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             port 1192&lt;br /&gt;
         }&lt;br /&gt;
         protocol udp&lt;br /&gt;
     }&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
== Space VPN Forward chain ==&lt;br /&gt;
 name spacevpn-in {&lt;br /&gt;
     default-action drop&lt;br /&gt;
     rule 1 {&lt;br /&gt;
         action accept&lt;br /&gt;
         state {&lt;br /&gt;
             established enable&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 2 {&lt;br /&gt;
         action accept&lt;br /&gt;
         state {&lt;br /&gt;
             related enable&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 5 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description icmp&lt;br /&gt;
         protocol icmp&lt;br /&gt;
     }&lt;br /&gt;
     rule 6 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description ipam.nurd.space&lt;br /&gt;
         destination {&lt;br /&gt;
             address 10.208.10.42&lt;br /&gt;
             port 80,443&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
     }&lt;br /&gt;
     rule 9 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description BGP&lt;br /&gt;
         destination {&lt;br /&gt;
             port 179&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
         source {&lt;br /&gt;
             group {&lt;br /&gt;
                 address-group SpaceVPN-BGP&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 10 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description &amp;quot;ipam dns&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             address 10.208.10.42&lt;br /&gt;
             port 53&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp_udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 11 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description backup01&lt;br /&gt;
         destination {&lt;br /&gt;
             address 10.208.10.7&lt;br /&gt;
         }&lt;br /&gt;
         protocol all&lt;br /&gt;
     }&lt;br /&gt;
     rule 13 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description Bacula&lt;br /&gt;
         destination {&lt;br /&gt;
             port 9102&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp&lt;br /&gt;
     }&lt;br /&gt;
     rule 14 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description Ansible.ti&lt;br /&gt;
         protocol all&lt;br /&gt;
         source {&lt;br /&gt;
             address 10.209.60.22&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 17 {&lt;br /&gt;
         action accept&lt;br /&gt;
         description resolver&lt;br /&gt;
         destination {&lt;br /&gt;
             address 192.168.1.2&lt;br /&gt;
             port 53&lt;br /&gt;
         }&lt;br /&gt;
         protocol tcp_udp&lt;br /&gt;
     }&lt;br /&gt;
     rule 9990 {&lt;br /&gt;
         action drop&lt;br /&gt;
         description &amp;quot;block local&amp;quot;&lt;br /&gt;
         destination {&lt;br /&gt;
             group {&lt;br /&gt;
                 address-group NURD-subnets&lt;br /&gt;
             }&lt;br /&gt;
         }&lt;br /&gt;
     }&lt;br /&gt;
     rule 9999 {&lt;br /&gt;
         action accept&lt;br /&gt;
     }&lt;br /&gt;
 }&lt;/div&gt;</summary>
		<author><name>Zarya</name></author>
	</entry>
</feed>