115 lines
6.2 KiB
YAML
115 lines
6.2 KiB
YAML
---
|
|
# Port and address maps are name -> value so group_vars and host_vars levels
|
|
# merge into one map (hash_behaviour = merge); a null value drops an entry.
|
|
# Ports are numbers or "first-last" ranges.
|
|
firewall:
|
|
public:
|
|
tcp: {}
|
|
udp: {}
|
|
# Accepted only from the geo sets or the admin set.
|
|
geo:
|
|
tcp: {}
|
|
# Accepted on wt0 before the public zone is evaluated.
|
|
vpn:
|
|
tcp: {}
|
|
udp: {}
|
|
# tcp: ports accepted from the admin set alone, never from the geo sets.
|
|
admin:
|
|
tcp: {}
|
|
v4: {}
|
|
v6: {}
|
|
# Metrics scrapers: on wt0 only these source addresses reach the listed tcp
|
|
# ports (the vpn zone applies to every peer). Rendered only when both are set.
|
|
scrapers:
|
|
tcp: {}
|
|
v4: {}
|
|
v6: {}
|
|
# Interface names (nft wildcards allowed) whose traffic is trusted.
|
|
internal_ifaces: {}
|
|
# Guest bridges (Proxmox vmbr*): DHCP, router solicitations and the public
|
|
# zone only, never the geo ports.
|
|
guest_ifaces: {}
|
|
# Kubernetes ring: pod interfaces, and node NetBird IPs / pod CIDRs on wt0.
|
|
cluster:
|
|
ifaces: {}
|
|
v4: {}
|
|
v6: {}
|
|
# IPv4 port forwards: name -> {daddr, to, tcp: ports, udp: ports}, ports as in
|
|
# the maps above. Forwarded traffic passes the forward hook, not input.
|
|
dnat: {}
|
|
# IPv4 source NAT: name -> nft match, e.g. 'oifname "vmbr0"'.
|
|
masquerade: {}
|
|
# Forwarded traffic to guarded guests: name -> {ifaces, v4, v6}, where v4 and
|
|
# v6 are {daddr, tcp: ports, icmp: icmp or icmpv6 types}. Replies and traffic
|
|
# in on ifaces pass, the listed ports and types pass, the rest to daddr drops;
|
|
# traffic to other addresses is not filtered.
|
|
forward_guard: {}
|
|
# Limits on new inbound TCP connections per service, applied to the public and geo ports the host serves (input) and to
|
|
# DNATed traffic (forward: port forwards and Docker-published ports), after the admin, cluster, VPN, guest and internal
|
|
# sources and the public_ips of every inventory host (IPv4 per address, IPv6 per /64) are exempted. Each service has a SYN
|
|
# meter with a tier per source (IPv4 /32, IPv6 /64) and a tier per range (IPv4 /24, IPv6 /48) at rate * range_factor. Its
|
|
# excess drops with the log prefix fw-rl-syn-addr: (source tier) or fw-rl-syn-range: (range tier); a spoofed source can trigger
|
|
# both, so they are evidence only. A handshake meter per source (same rate and burst, no range tier) counts the packet
|
|
# that completes a TCP handshake, which a spoofed source cannot send; its excess is logged with fw-rl-hs: and reset.
|
|
# Log limit: log.ratelimit_rate.
|
|
# name -> {ports: port or list, rate: connections per `per`, per: second|minute (minute), burst: connections (2 * rate),
|
|
# range_factor_v4, range_factor_v6: override the factors below}; null drops a service, a service is idle unless a port is served.
|
|
# Values are 3x the highest legitimate rate seen, with a floor of 12 per minute (3x four connections per minute) where
|
|
# there is no or too little history; the measurement is noted at each service.
|
|
ratelimit:
|
|
range_factor:
|
|
v4: 6
|
|
v6: 3
|
|
services:
|
|
# 14 days of sshd Accepted lines in VictoriaLogs (all hosts, per host and source, /64 and /24 grouped): at most 8 per
|
|
# minute and 4 per 10 seconds from one address or /64 (Ansible runs), 22 per 10 minutes.
|
|
ssh:
|
|
ports: 22
|
|
rate: 24
|
|
# 14 days of Traefik access logs of the cluster: distinct client ports of one source within a minute, which bounds the
|
|
# new connections, at most 51 (IPv4) and 58 (IPv6 /64); 16 per second at most. Applies to the host ports 80 and 443.
|
|
web:
|
|
ports: [80, 443]
|
|
rate: 180
|
|
# Kernel log of dropped inbound packets (fw-in-drop: ), rate-limited connections (fw-rl-syn-addr: , fw-rl-syn-range: , fw-rl-hs: ) and of rejected
|
|
# outbound mail (fw-out-reject: ), read from the journal by CrowdSec. Each
|
|
# rate is one limit shared by all matching packets.
|
|
log:
|
|
in_rate: "5/second burst 30 packets"
|
|
# One limit each for fw-rl-syn-addr: , fw-rl-syn-range: and fw-rl-hs: , shared by all services.
|
|
ratelimit_rate: "5/second burst 30 packets"
|
|
out_rate: "6/minute burst 5 packets"
|
|
# Lets the kernel log the nft log statements of container network
|
|
# namespaces (LXC guests) into the host kernel log.
|
|
all_netns: false
|
|
# Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ), FireHOL (fw-firehol-in: , fw-firehol-out: ) and scanner (fw-scanners-in: ) chains, one limit each.
|
|
spamhaus_rate: "6/minute burst 10 packets"
|
|
# Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
|
|
# (input, forward), traffic to them is rejected (output, forward). The sets
|
|
# are refreshed daily by nft-host-spamhaus.
|
|
spamhaus: true
|
|
# FireHOL level1 (IPv4): treated like the Spamhaus lists, with the prefixes
|
|
# fw-firehol-in: and fw-firehol-out: and the same log limit. Entries in
|
|
# private or reserved space and ones holding an address of the host are left
|
|
# out. Refreshed daily by nft-host-firehol.
|
|
firehol: true
|
|
# Internet-wide scanners (Censys, Shodan, ONYPHE, Shadowserver, ...), IPv4
|
|
# and IPv6: the cidr files of github.com/OpenFilters/internet-scanners
|
|
# (Unlicense). Inbound traffic from the listed networks drops (input,
|
|
# forward) once the established rule has passed; outbound traffic is never
|
|
# filtered. Log prefix fw-scanners-in: with the Spamhaus log limit, which
|
|
# CrowdSec whitelists. Entries in private or reserved space, overlapping the
|
|
# admin, scraper and cluster sets, the CrowdSec whitelist or the public_ips
|
|
# of any host, and ones holding an address of the host are left out
|
|
# (/etc/nft-host-scanners.allowlist). Refreshed daily by nft-host-scanners.
|
|
scanners: true
|
|
# Reject outbound TCP 25; the mail group turns it off.
|
|
block_smtp_out: true
|
|
# EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo
|
|
# ports to the admin set; a load peaks at about 60 MB of kernel memory, too much for a 1 GB host.
|
|
geo_countries: [at, be, bg, hr, cy, cz, dk, ee, fi, fr, de, gr, hu, ie, it, lv, lt, lu, mt, nl, pl, pt, ro, sk, si, es, se, ch, "no", gb, is, li]
|
|
rollback_seconds: 120
|
|
# name -> shell command that has to exit 0 through the new rule set before the
|
|
# rollback is disarmed; retried for a quarter of the rollback window.
|
|
confirm: {}
|