Groups
group {
address-group NURD-subnets {
address 172.31.0.0/16
address 192.168.1.0/24
address 192.168.2.0/24
address 10.208.0.0/16
}
address-group SpaceVPN-BGP {
address 172.31.250.2
address 192.168.21.1
}
address-group techinc-filers {
address 10.0.21.68
address 10.0.21.69
address 10.0.21.72
address 10.0.21.73
address 10.0.20.0/24
address 10.209.50.16
address 10.209.60.22
address 10.209.50.1
address 10.209.50.2
}
ipv6-address-group drop-group {
ipv6-address 2001:470:7a9c:31::11
ipv6-address 2001:470:7a9c:31::10
ipv6-address 2001:470:7a9c:1337::222
ipv6-address 2001:470:7a9c:1337::221
}
network-group RFC1918 {
network 172.16.0.0/12
network 10.0.0.0/8
network 192.168.0.0/16
}
}
UPC Forward Chain
name upc-in {
default-action drop
rule 1 {
action accept
description "Accept related"
state {
related enable
}
}
rule 2 {
action accept
description "Accept established"
state {
established enable
}
}
rule 4 {
action accept
description "Allow icmp"
icmp {
type-name any
}
protocol icmp
}
rule 5 {
action accept
description "HE Tunnel endpoint"
source {
address 216.66.84.46
}
}
rule 6 {
action accept
description "Openvpn inbound"
destination {
port 1194
}
protocol udp
}
rule 7 {
action accept
description "Rev proxy"
destination {
port 80
}
protocol tcp
}
rule 8 {
action accept
description "Rev proxy"
destination {
port 443
}
protocol tcp
}
rule 9 {
action accept
description "SSH Gitlab"
destination {
port 22
}
protocol tcp
}
rule 10 {
action accept
description IKE
protocol 50
}
rule 11 {
action accept
destination {
port 500
}
protocol udp
}
rule 13 {
action accept
description "port 122 ssh to tankstation"
destination {
port 122
}
protocol tcp
}
rule 14 {
action accept
description "mosh tankstation"
destination {
port 60000-60050
}
protocol udp
}
}
UPC Input chain
name upc-local {
default-action drop
rule 1 {
action accept
description "Allow Established"
log disable
state {
established enable
}
}
rule 2 {
action accept
description "Allow Related"
log disable
state {
related enable
}
}
rule 3 {
action accept
description "Allow dhcp"
destination {
port 67,68
}
log disable
protocol udp
}
rule 4 {
action accept
description "Allow dns"
destination {
port 53
}
log disable
protocol tcp_udp
}
rule 5 {
action accept
description "Allow ntp"
destination {
port 123
}
limit {
burst 1
rate 5/second
}
log enable
protocol udp
}
rule 6 {
action accept
description "Allow ICMP"
limit {
burst 1
rate 5/second
}
protocol icmp
}
rule 7 {
action accept
description "Zarya - home.gigafreak.net"
source {
address 84.245.27.185
}
}
rule 8 {
action accept
description "HE Tunnel endpoint"
source {
address 216.66.84.46
}
}
rule 9 {
action accept
description "Openvpn inbound"
destination {
port 1194
}
protocol udp
}
rule 11 {
action accept
description "Openvpn Skillz"
destination {
port 1192
}
protocol udp
}
}
Space VPN Forward chain
name spacevpn-in {
default-action drop
rule 1 {
action accept
state {
established enable
}
}
rule 2 {
action accept
state {
related enable
}
}
rule 5 {
action accept
description icmp
protocol icmp
}
rule 6 {
action accept
description ipam.nurd.space
destination {
address 10.208.10.42
port 80,443
}
protocol tcp
}
rule 9 {
action accept
description BGP
destination {
port 179
}
protocol tcp
source {
group {
address-group SpaceVPN-BGP
}
}
}
rule 10 {
action accept
description "ipam dns"
destination {
address 10.208.10.42
port 53
}
protocol tcp_udp
}
rule 11 {
action accept
description backup01
destination {
address 10.208.10.7
}
protocol all
}
rule 13 {
action accept
description Bacula
destination {
port 9102
}
protocol tcp
}
rule 14 {
action accept
description Ansible.ti
protocol all
source {
address 10.209.60.22
}
}
rule 17 {
action accept
description resolver
destination {
address 192.168.1.2
port 53
}
protocol tcp_udp
}
rule 9990 {
action drop
description "block local"
destination {
group {
address-group NURD-subnets
}
}
}
rule 9999 {
action accept
}
}