From c054d22c4818d916ac6dd9c8d7a7a2c614408e17 Mon Sep 17 00:00:00 2001
From: Egor Tensin <Egor.Tensin@gmail.com>
Date: Sun, 20 Aug 2023 23:02:06 +0200
Subject: append .j2 extension to templates

I saw a good point somewhere that it should help with syntax
highlighting.
---
 roles/firewall/templates/rules.v6 | 60 ---------------------------------------
 1 file changed, 60 deletions(-)
 delete mode 100644 roles/firewall/templates/rules.v6

(limited to 'roles/firewall/templates/rules.v6')

diff --git a/roles/firewall/templates/rules.v6 b/roles/firewall/templates/rules.v6
deleted file mode 100644
index 2e94e25..0000000
--- a/roles/firewall/templates/rules.v6
+++ /dev/null
@@ -1,60 +0,0 @@
-{{ ansible_managed | comment }}
-
-*filter
-
-# By default, drop incoming packets:
-:INPUT DROP [0:0]
-:FORWARD DROP [0:0]
-# By default, accept outgoing packets:
-:OUTPUT ACCEPT [0:0]
-
-# Accept packets for localhost:
--A INPUT -i lo -j ACCEPT
-
-# Accept any packet for an open connection:
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-
-# The SSH port is always open:
-{% set ssh_port = hostvars[inventory_hostname].ansible_port %}
-
-# Open TCP ports:
-{% set tcp_ports = [ssh_port] + firewall_ports_tcp + firewall_ports6_tcp %}
-{% set tcp_ports = tcp_ports | unique %}
-
-{% for port in tcp_ports %}
-{% set num = port.port if port.port is defined else port %}
-{% set src = '-s ' + port.source if port.source is defined else '' %}
--A INPUT -p tcp {{ src }} --dport {{ num }} -m conntrack --ctstate NEW -j ACCEPT
-{% endfor %}
-
-# Open UDP ports:
-{% set udp_ports = firewall_ports_udp + firewall_ports6_udp %}
-{% set udp_ports = udp_ports | unique %}
-
-{% for port in udp_ports %}
-{% set num = port.port if port.port is defined else port %}
-{% set src = '-s ' + port.source if port.source is defined else '' %}
--A INPUT -p udp {{ src }} --dport {{ num }} -j ACCEPT
-{% endfor %}
-
-# Any additional IPv6 rules:
-{{ firewall_rules6 | join('\n') }}
-
-# ICMP; allow only pings and rate-limit them:
--A INPUT -p icmpv6 --icmpv6-type echo-request -m hashlimit --hashlimit-upto 5/s --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-name icmp-echo-drop -j ACCEPT
-
-# ICMP; IPv6 stuff. To be honest, I don't really understand it; this was copied
-# from trailofbits/algo's rules.v6 template at
-#
-#     https://github.com/trailofbits/algo/blob/master/roles/common/templates/rules.v6.j2
-#
--A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
--A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
--A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
--A INPUT -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT
-
-# Log denies (this must be at the bottom of the file):
--A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables denied: " --log-level 4
-
-COMMIT
-- 
cgit v1.2.3