ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
181
services/oci-l4-relay-guest/firewall.go
Normal file
181
services/oci-l4-relay-guest/firewall.go
Normal file
|
|
@ -0,0 +1,181 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
)
|
||||
|
||||
func renderRuleset(configuration config, publicInterface string) string {
|
||||
smtpObservationWindow := 600
|
||||
if configuration.SMTPDeny != nil {
|
||||
smtpObservationWindow = configuration.SMTPDeny.MaximumObservationWindow
|
||||
}
|
||||
httpQuarantine := ""
|
||||
if configuration.RelayHTTPQuarantineEnabled {
|
||||
httpQuarantine = fmt.Sprintf(`
|
||||
iifname %q tcp flags syn tcp dport 443 update @recent_https_v4 { ip saddr timeout %dm } delete @http_quarantine_v4 { ip saddr }
|
||||
iifname %q tcp flags syn tcp dport 80 ip saddr @http_quarantine_v4 counter drop
|
||||
iifname %q tcp flags syn tcp dport 80 ip saddr != @recent_https_v4 meter unmatched_http_by_source size %d { ip saddr timeout %dm limit rate over %d/hour burst %d packets } update @http_quarantine_v4 { ip saddr timeout %dm } counter drop`,
|
||||
publicInterface, configuration.RelayHTTPSRecentMinutes,
|
||||
publicInterface,
|
||||
publicInterface, configuration.RelayTrackerMaxSources, configuration.RelayHTTPSRecentMinutes, configuration.RelayUnmatchedHTTPRate, configuration.RelayUnmatchedHTTPBurst, configuration.RelayHTTPQuarantineMinutes)
|
||||
}
|
||||
mailForward := ""
|
||||
mailDNAT := ""
|
||||
mailGuard := ""
|
||||
if configuration.MailRelayAddress != "" {
|
||||
mailForward = fmt.Sprintf(`
|
||||
iifname %q oifname "wg-oci0" ip daddr %s tcp dport { 25, 465, 993 } accept`, publicInterface, configuration.MailRelayAddress)
|
||||
mailDNAT = fmt.Sprintf(`
|
||||
iifname %q tcp dport { 25, 465, 993 } dnat ip to %s`, publicInterface, configuration.MailRelayAddress)
|
||||
mailGuard = fmt.Sprintf(`
|
||||
iifname %q tcp flags syn tcp dport 25 ip saddr @smtp_syn_quarantine_v4 counter name smtp_syn_quarantine_dropped drop
|
||||
iifname %q tcp flags syn tcp dport 25 meter smtp_syn_by_source size %d { ip saddr timeout 1m limit rate over %d/minute burst %d packets } update @smtp_syn_quarantine_v4 { ip saddr timeout %ds } counter name smtp_syn_source_dropped drop
|
||||
iifname %q tcp flags syn tcp dport 25 limit rate over %d/second burst %d packets counter name smtp_syn_aggregate_dropped drop
|
||||
iifname %q tcp dport 25 limit rate over %d/second burst %d packets counter name smtp_packet_aggregate_dropped drop
|
||||
iifname %q tcp flags syn tcp dport { 465, 993 } ip saddr @auth_syn_quarantine_v4 counter name auth_syn_quarantine_dropped drop
|
||||
iifname %q tcp flags syn tcp dport { 465, 993 } meter auth_syn_by_source size %d { ip saddr timeout 1m limit rate over %d/minute burst %d packets } update @auth_syn_quarantine_v4 { ip saddr timeout 10m } counter name auth_syn_source_dropped drop
|
||||
iifname %q tcp flags syn tcp dport { 465, 993 } limit rate over %d/second burst %d packets counter name auth_syn_aggregate_dropped drop
|
||||
iifname %q tcp dport { 465, 993 } limit rate over %d/second burst %d packets counter name auth_packet_aggregate_dropped drop`,
|
||||
publicInterface,
|
||||
publicInterface, configuration.RelayTrackerMaxSources, configuration.RelaySMTPSYNRate, configuration.RelaySMTPSYNBurst, smtpObservationWindow,
|
||||
publicInterface, configuration.RelaySMTPSYNAggregateRate, configuration.RelaySMTPSYNAggregateBurst,
|
||||
publicInterface, configuration.RelaySMTPPacketAggregateRate, configuration.RelaySMTPPacketAggregateBurst,
|
||||
publicInterface,
|
||||
publicInterface, configuration.RelayTrackerMaxSources, configuration.RelayAuthSYNRate, configuration.RelayAuthSYNBurst,
|
||||
publicInterface, configuration.RelayAuthSYNAggregateRate, configuration.RelayAuthSYNAggregateBurst,
|
||||
publicInterface, configuration.RelayAuthPacketAggregateRate, configuration.RelayAuthPacketAggregateBurst)
|
||||
}
|
||||
return strings.TrimSpace(fmt.Sprintf(`
|
||||
flush ruleset
|
||||
table inet oci_l4_relay_web_allow {
|
||||
counter web_allow_denied {}
|
||||
chain ingress {
|
||||
type filter hook prerouting priority raw - 20; policy accept;
|
||||
iifname %q tcp dport { 80, 443, 465, 993 } counter name web_allow_denied drop
|
||||
}
|
||||
}
|
||||
|
||||
table inet oci_l4_relay_smtp_deny {
|
||||
set denied_v4 {
|
||||
type ipv4_addr
|
||||
flags interval, timeout
|
||||
}
|
||||
counter smtp_denied {}
|
||||
chain ingress {
|
||||
type filter hook prerouting priority raw - 19; policy accept;
|
||||
iifname %q tcp dport 25 ip saddr @denied_v4 counter name smtp_denied drop
|
||||
}
|
||||
}
|
||||
|
||||
table inet oci_l4_relay {
|
||||
counter web_packet_aggregate_dropped {}
|
||||
counter web_syn_quarantine_dropped {}
|
||||
counter web_syn_source_dropped {}
|
||||
counter web_syn_aggregate_dropped {}
|
||||
counter smtp_packet_aggregate_dropped {}
|
||||
counter smtp_syn_aggregate_dropped {}
|
||||
counter smtp_syn_quarantine_dropped {}
|
||||
counter smtp_syn_source_dropped {}
|
||||
counter auth_packet_aggregate_dropped {}
|
||||
counter auth_syn_aggregate_dropped {}
|
||||
counter auth_syn_quarantine_dropped {}
|
||||
counter auth_syn_source_dropped {}
|
||||
|
||||
set recent_https_v4 {
|
||||
type ipv4_addr
|
||||
flags dynamic,timeout
|
||||
timeout %dm
|
||||
size %d
|
||||
}
|
||||
|
||||
set http_quarantine_v4 {
|
||||
type ipv4_addr
|
||||
flags dynamic,timeout
|
||||
timeout %dm
|
||||
size %d
|
||||
}
|
||||
|
||||
set syn_quarantine_v4 {
|
||||
type ipv4_addr
|
||||
flags dynamic,timeout
|
||||
counter
|
||||
timeout 1m
|
||||
size %d
|
||||
}
|
||||
|
||||
set smtp_syn_quarantine_v4 {
|
||||
type ipv4_addr
|
||||
flags dynamic,timeout
|
||||
counter
|
||||
timeout %ds
|
||||
size %d
|
||||
}
|
||||
|
||||
set auth_syn_quarantine_v4 {
|
||||
type ipv4_addr
|
||||
flags dynamic,timeout
|
||||
timeout 10m
|
||||
size %d
|
||||
}
|
||||
|
||||
chain ingress_guard {
|
||||
type filter hook prerouting priority raw - 10; policy accept;%s
|
||||
iifname %q tcp flags syn tcp dport { 80, 443 } ip saddr @syn_quarantine_v4 counter name web_syn_quarantine_dropped drop
|
||||
iifname %q tcp flags syn tcp dport { 80, 443 } meter web_syn_by_source size %d { ip saddr timeout 1m limit rate over %d/minute burst %d packets } update @syn_quarantine_v4 { ip saddr timeout 1m } counter name web_syn_source_dropped drop
|
||||
iifname %q tcp flags syn tcp dport { 80, 443 } limit rate over %d/second burst %d packets counter name web_syn_aggregate_dropped drop
|
||||
iifname %q tcp dport { 80, 443 } limit rate over %d/second burst %d packets counter name web_packet_aggregate_dropped drop%s
|
||||
}
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
iifname "lo" accept
|
||||
ct state established,related accept
|
||||
icmp type 3 icmp code 4 accept
|
||||
iifname %q udp dport %d accept
|
||||
iifname "wg-oci0" tcp dport %d accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority filter; policy drop;
|
||||
oifname "lo" accept
|
||||
ct state established,related accept
|
||||
ip daddr 169.254.169.254 tcp dport 80 accept
|
||||
ip daddr 169.254.169.254 udp dport { 53, 123 } accept
|
||||
ip daddr 169.254.169.254 tcp dport 53 accept
|
||||
udp sport 68 udp dport 67 accept
|
||||
udp sport %d accept
|
||||
tcp dport 443 accept
|
||||
icmp type { 3, 11, 12 } accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
ct state established,related accept
|
||||
iifname %q oifname "wg-oci0" ip daddr %s tcp dport { 80, 443 } accept%s
|
||||
iifname "wg-oci0" oifname %q ct state established,related accept
|
||||
}
|
||||
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
iifname %q tcp dport { 80, 443 } dnat ip to %s%s
|
||||
}
|
||||
}
|
||||
`, publicInterface, publicInterface,
|
||||
configuration.RelayHTTPSRecentMinutes, configuration.RelayTrackerMaxSources,
|
||||
configuration.RelayHTTPQuarantineMinutes, configuration.RelayTrackerMaxSources,
|
||||
configuration.RelayTrackerMaxSources,
|
||||
smtpObservationWindow,
|
||||
configuration.RelayTrackerMaxSources,
|
||||
configuration.RelayTrackerMaxSources,
|
||||
httpQuarantine,
|
||||
publicInterface,
|
||||
publicInterface, configuration.RelayTrackerMaxSources, configuration.RelayWebSYNRate, configuration.RelayWebSYNBurst,
|
||||
publicInterface, configuration.RelayWebSYNAggregateRate, configuration.RelayWebSYNAggregateBurst,
|
||||
publicInterface, configuration.RelayWebPacketAggregateRate, configuration.RelayWebPacketAggregateBurst,
|
||||
mailGuard,
|
||||
publicInterface, configuration.WireGuardListenPort, configuration.RelayMetricsPort,
|
||||
configuration.WireGuardListenPort,
|
||||
publicInterface, configuration.GatewayRelayAddress, mailForward, publicInterface,
|
||||
publicInterface, configuration.GatewayRelayAddress, mailDNAT)) + "\n"
|
||||
}
|
||||
Loading…
Reference in a new issue