mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
Toby
@@ -0,0 +1,84 @@
|
||||
---
|
||||
name: firewall-config
|
||||
description: Configure iptables, nftables, and cloud firewalls. Implement network segmentation and traffic filtering. Use when securing network perimeters or implementing security zones.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Firewall Configuration
|
||||
|
||||
Configure host-based and cloud firewalls for network security.
|
||||
|
||||
## iptables
|
||||
|
||||
```bash
|
||||
# Default policies
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
|
||||
# Allow established connections
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Allow loopback
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
|
||||
# Allow SSH
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
# Allow HTTP/HTTPS
|
||||
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
|
||||
|
||||
# Save rules
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
## nftables
|
||||
|
||||
```bash
|
||||
#!/usr/sbin/nft -f
|
||||
flush ruleset
|
||||
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
ct state established,related accept
|
||||
iif "lo" accept
|
||||
tcp dport { 22, 80, 443 } accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 0; policy accept;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## AWS Security Groups
|
||||
|
||||
```bash
|
||||
aws ec2 create-security-group --group-name web-sg --description "Web server SG"
|
||||
|
||||
aws ec2 authorize-security-group-ingress \
|
||||
--group-name web-sg \
|
||||
--protocol tcp --port 443 \
|
||||
--cidr 0.0.0.0/0
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Default deny policy
|
||||
- Minimal rule sets
|
||||
- Regular rule audits
|
||||
- Log denied traffic
|
||||
- Document all rules
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [linux-hardening](../../hardening/linux-hardening/) - System security
|
||||
- [aws-vpc](../../../infrastructure/cloud-aws/aws-vpc/) - AWS networking
|
||||
@@ -0,0 +1,103 @@
|
||||
#!/bin/bash
|
||||
# iptables Firewall Rules Template
|
||||
# Customize and apply with: bash iptables-rules.sh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Flush existing rules
|
||||
iptables -F
|
||||
iptables -X
|
||||
iptables -t nat -F
|
||||
iptables -t nat -X
|
||||
|
||||
# Set default policies
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# LOOPBACK
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
iptables -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# ESTABLISHED CONNECTIONS
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# INVALID PACKETS
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# ICMP (Ping)
|
||||
#------------------------------------------------------------------------------
|
||||
# Allow ping (optional - comment out to disable)
|
||||
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
|
||||
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# SSH (Rate Limited)
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# WEB SERVICES (Uncomment as needed)
|
||||
#------------------------------------------------------------------------------
|
||||
# HTTP
|
||||
# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||||
|
||||
# HTTPS
|
||||
# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# APPLICATION PORTS (Customize)
|
||||
#------------------------------------------------------------------------------
|
||||
# Application (example: 8080)
|
||||
# iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
|
||||
|
||||
# From specific network only
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# DATABASE (Internal Only)
|
||||
#------------------------------------------------------------------------------
|
||||
# PostgreSQL from internal network
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 5432 -j ACCEPT
|
||||
|
||||
# MySQL from internal network
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 3306 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# MONITORING
|
||||
#------------------------------------------------------------------------------
|
||||
# Prometheus metrics
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9090 -j ACCEPT
|
||||
|
||||
# Node exporter
|
||||
# iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 9100 -j ACCEPT
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# LOGGING
|
||||
#------------------------------------------------------------------------------
|
||||
# Log dropped packets (before final DROP)
|
||||
iptables -A INPUT -j LOG --log-prefix "iptables-dropped: " --log-level 4 -m limit --limit 5/min
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# FINAL DROP (Implicit with policy, but explicit for clarity)
|
||||
#------------------------------------------------------------------------------
|
||||
iptables -A INPUT -j DROP
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# SAVE RULES
|
||||
#------------------------------------------------------------------------------
|
||||
echo "Saving rules..."
|
||||
iptables-save > /etc/iptables/rules.v4 2>/dev/null || iptables-save > /tmp/iptables-rules.v4
|
||||
|
||||
echo "Firewall configured successfully!"
|
||||
iptables -L -n -v
|
||||
@@ -0,0 +1,127 @@
|
||||
# iptables Reference Guide
|
||||
|
||||
## Chain Overview
|
||||
|
||||
```
|
||||
PREROUTING
|
||||
│
|
||||
▼
|
||||
┌─────────┐
|
||||
│ ROUTING │
|
||||
└────┬────┘
|
||||
│
|
||||
┌────────────┼────────────┐
|
||||
│ │ │
|
||||
▼ ▼ ▼
|
||||
INPUT FORWARD OUTPUT
|
||||
│ │ │
|
||||
▼ │ ▼
|
||||
Local Process │ Local Process
|
||||
│
|
||||
▼
|
||||
POSTROUTING
|
||||
```
|
||||
|
||||
## Tables
|
||||
|
||||
| Table | Purpose | Chains |
|
||||
|-------|---------|--------|
|
||||
| filter | Default, packet filtering | INPUT, FORWARD, OUTPUT |
|
||||
| nat | Network Address Translation | PREROUTING, OUTPUT, POSTROUTING |
|
||||
| mangle | Packet alteration | All chains |
|
||||
| raw | Connection tracking exemption | PREROUTING, OUTPUT |
|
||||
|
||||
## Basic Commands
|
||||
|
||||
```bash
|
||||
# List rules
|
||||
iptables -L -n -v # All filter rules
|
||||
iptables -L INPUT -n -v # INPUT chain only
|
||||
iptables -t nat -L -n -v # NAT table
|
||||
|
||||
# Add rules
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT # Insert at position 1
|
||||
|
||||
# Delete rules
|
||||
iptables -D INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -D INPUT 3 # Delete rule #3
|
||||
|
||||
# Flush rules
|
||||
iptables -F # Flush all filter rules
|
||||
iptables -t nat -F # Flush NAT rules
|
||||
|
||||
# Set policy
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
```
|
||||
|
||||
## Common Rules
|
||||
|
||||
### Allow Established Connections
|
||||
```bash
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
```
|
||||
|
||||
### Allow Loopback
|
||||
```bash
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
iptables -A OUTPUT -o lo -j ACCEPT
|
||||
```
|
||||
|
||||
### Allow SSH
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
# Rate limit SSH
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
|
||||
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
|
||||
```
|
||||
|
||||
### Allow Web Traffic
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||||
```
|
||||
|
||||
### Allow from Specific IP/Network
|
||||
```bash
|
||||
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
|
||||
iptables -A INPUT -s 10.0.0.5 -p tcp --dport 5432 -j ACCEPT
|
||||
```
|
||||
|
||||
### Block IP
|
||||
```bash
|
||||
iptables -A INPUT -s 1.2.3.4 -j DROP
|
||||
```
|
||||
|
||||
### Log Dropped Packets
|
||||
```bash
|
||||
iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
|
||||
iptables -A INPUT -j DROP
|
||||
```
|
||||
|
||||
## NAT Rules
|
||||
|
||||
### SNAT (Source NAT)
|
||||
```bash
|
||||
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
```
|
||||
|
||||
### DNAT (Destination NAT / Port Forwarding)
|
||||
```bash
|
||||
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080
|
||||
```
|
||||
|
||||
## Save/Restore
|
||||
|
||||
```bash
|
||||
# Save rules
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
ip6tables-save > /etc/iptables/rules.v6
|
||||
|
||||
# Restore rules
|
||||
iptables-restore < /etc/iptables/rules.v4
|
||||
ip6tables-restore < /etc/iptables/rules.v6
|
||||
```
|
||||
@@ -0,0 +1,91 @@
|
||||
#!/bin/bash
|
||||
# Firewall Configuration Audit Script
|
||||
# Usage: ./firewall-audit.sh
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "========================================="
|
||||
echo "Firewall Configuration Audit"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Detect firewall type
|
||||
if command -v ufw &>/dev/null; then
|
||||
FIREWALL="ufw"
|
||||
elif command -v firewall-cmd &>/dev/null; then
|
||||
FIREWALL="firewalld"
|
||||
elif command -v nft &>/dev/null; then
|
||||
FIREWALL="nftables"
|
||||
else
|
||||
FIREWALL="iptables"
|
||||
fi
|
||||
|
||||
echo "Detected Firewall: $FIREWALL"
|
||||
echo ""
|
||||
|
||||
case "$FIREWALL" in
|
||||
ufw)
|
||||
echo "UFW Status:"
|
||||
echo "----------"
|
||||
ufw status verbose
|
||||
echo ""
|
||||
echo "UFW Rules (numbered):"
|
||||
echo "--------------------"
|
||||
ufw status numbered
|
||||
echo ""
|
||||
echo "UFW Application Profiles:"
|
||||
echo "------------------------"
|
||||
ufw app list
|
||||
;;
|
||||
|
||||
firewalld)
|
||||
echo "Firewalld Status:"
|
||||
echo "----------------"
|
||||
firewall-cmd --state
|
||||
echo ""
|
||||
echo "Active Zones:"
|
||||
echo "-------------"
|
||||
firewall-cmd --get-active-zones
|
||||
echo ""
|
||||
echo "Default Zone: $(firewall-cmd --get-default-zone)"
|
||||
echo ""
|
||||
echo "All Zone Rules:"
|
||||
echo "--------------"
|
||||
for zone in $(firewall-cmd --get-zones); do
|
||||
echo "--- Zone: $zone ---"
|
||||
firewall-cmd --zone=$zone --list-all 2>/dev/null || true
|
||||
echo ""
|
||||
done
|
||||
;;
|
||||
|
||||
nftables)
|
||||
echo "nftables Ruleset:"
|
||||
echo "----------------"
|
||||
nft list ruleset
|
||||
;;
|
||||
|
||||
iptables)
|
||||
echo "iptables Rules (Filter):"
|
||||
echo "-----------------------"
|
||||
iptables -L -n -v --line-numbers
|
||||
echo ""
|
||||
echo "iptables Rules (NAT):"
|
||||
echo "--------------------"
|
||||
iptables -t nat -L -n -v --line-numbers 2>/dev/null || true
|
||||
echo ""
|
||||
echo "ip6tables Rules:"
|
||||
echo "---------------"
|
||||
ip6tables -L -n -v --line-numbers 2>/dev/null || true
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Open Ports (listening):"
|
||||
echo "========================================="
|
||||
ss -tlnp 2>/dev/null || netstat -tlnp
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Audit complete"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,80 @@
|
||||
#!/bin/bash
|
||||
# UFW Firewall Setup Script
|
||||
# Usage: ./setup-ufw.sh [--apply]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
APPLY="${1:-}"
|
||||
|
||||
if [ "$APPLY" != "--apply" ]; then
|
||||
echo "DRY RUN MODE - showing commands only"
|
||||
echo "Run with --apply to execute"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
run_cmd() {
|
||||
if [ "$APPLY" == "--apply" ]; then
|
||||
eval "$1"
|
||||
else
|
||||
echo "[DRY RUN] $1"
|
||||
fi
|
||||
}
|
||||
|
||||
echo "========================================="
|
||||
echo "UFW Firewall Setup"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Reset UFW
|
||||
echo "Resetting UFW to defaults..."
|
||||
run_cmd "ufw --force reset"
|
||||
|
||||
# Set default policies
|
||||
echo ""
|
||||
echo "Setting default policies..."
|
||||
run_cmd "ufw default deny incoming"
|
||||
run_cmd "ufw default allow outgoing"
|
||||
|
||||
# Essential services
|
||||
echo ""
|
||||
echo "Allowing essential services..."
|
||||
|
||||
# SSH (rate limited)
|
||||
run_cmd "ufw limit ssh comment 'SSH with rate limiting'"
|
||||
|
||||
# Common services (uncomment as needed)
|
||||
echo ""
|
||||
echo "Common service rules (customize as needed):"
|
||||
|
||||
# Web server
|
||||
# run_cmd "ufw allow 80/tcp comment 'HTTP'"
|
||||
# run_cmd "ufw allow 443/tcp comment 'HTTPS'"
|
||||
|
||||
# Database (restrict to specific IPs)
|
||||
# run_cmd "ufw allow from 10.0.0.0/8 to any port 5432 comment 'PostgreSQL from internal'"
|
||||
# run_cmd "ufw allow from 10.0.0.0/8 to any port 3306 comment 'MySQL from internal'"
|
||||
|
||||
# Application ports
|
||||
# run_cmd "ufw allow 8080/tcp comment 'Application'"
|
||||
|
||||
# Enable logging
|
||||
echo ""
|
||||
echo "Enabling logging..."
|
||||
run_cmd "ufw logging medium"
|
||||
|
||||
# Enable firewall
|
||||
echo ""
|
||||
echo "Enabling UFW..."
|
||||
run_cmd "ufw --force enable"
|
||||
|
||||
# Show status
|
||||
echo ""
|
||||
echo "Final status:"
|
||||
if [ "$APPLY" == "--apply" ]; then
|
||||
ufw status verbose
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Setup complete"
|
||||
echo "========================================="
|
||||
Reference in New Issue
Block a user