[Auto-Sync] Atualização das configurações em srvproxy001.itguys.com.br - 2025-09-16 19:22:23
This commit is contained in:
srvproxy001.itguys.com.br
parent
86dd891052
commit
63bd86a06b
|
|
@ -2,3 +2,9 @@
|
|||
# Linhas que começam com '#' são ignoradas.
|
||||
/etc/nginx
|
||||
/etc/fail2ban
|
||||
/etc/resolv.conf
|
||||
/etc/nsswitch.conf
|
||||
/etc/hosts
|
||||
/etc/ufw
|
||||
/lib/systemd/system/nginx.service
|
||||
/etc/systemd/system/nginx.service.d/override.conf
|
||||
|
|
|
|||
|
|
@ -0,0 +1,9 @@
|
|||
127.0.0.1 localhost
|
||||
172.16.254.1 srvproxy001.itguys.com.br srvproxy001
|
||||
10.10.253.128 git.itguys.com.br git
|
||||
172.16.254.59 zammad.itguys.com.br zammad
|
||||
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# Stop dance for nginx
|
||||
# =======================
|
||||
#
|
||||
# ExecStop sends SIGQUIT (graceful stop) to the nginx process.
|
||||
# If, after 5s (--retry QUIT/5) nginx is still running, systemd takes control
|
||||
# and sends SIGTERM (fast shutdown) to the main process.
|
||||
# After another 5s (TimeoutStopSec=5), and if nginx is alive, systemd sends
|
||||
# SIGKILL to all the remaining processes in the process group (KillMode=mixed).
|
||||
#
|
||||
# nginx signals reference doc:
|
||||
# http://nginx.org/en/docs/control.html
|
||||
#
|
||||
[Unit]
|
||||
Description=A high performance web server and a reverse proxy server
|
||||
Documentation=man:nginx(8)
|
||||
After=network-online.target remote-fs.target nss-lookup.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/nginx.pid
|
||||
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
|
||||
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
|
||||
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
|
||||
ExecStop=-/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid
|
||||
TimeoutStopSec=5
|
||||
KillMode=mixed
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
# /etc/nsswitch.conf
|
||||
#
|
||||
# Example configuration of GNU Name Service Switch functionality.
|
||||
# If you have the `glibc-doc-reference' and `info' packages installed, try:
|
||||
# `info libc "Name Service Switch"' for information about this file.
|
||||
|
||||
passwd: files
|
||||
group: files
|
||||
shadow: files
|
||||
gshadow: files
|
||||
|
||||
hosts: files dns
|
||||
networks: files
|
||||
|
||||
protocols: db files
|
||||
services: db files
|
||||
ethers: db files
|
||||
rpc: db files
|
||||
|
||||
netgroup: nis
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
[Service]
|
||||
LimitNOFILE=65535
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
search itguys.com.br
|
||||
nameserver 172.16.254.252
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
#!/bin/sh
|
||||
#
|
||||
# after.init: if executable, called by ufw-init. See 'man ufw-framework' for
|
||||
# details. Note that output from these scripts is not seen via the
|
||||
# the ufw command, but instead via ufw-init.
|
||||
#
|
||||
# Copyright 2013 Canonical Ltd.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License version 3,
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
# typically required
|
||||
;;
|
||||
stop)
|
||||
# typically required
|
||||
;;
|
||||
status)
|
||||
# optional
|
||||
;;
|
||||
flush-all)
|
||||
# optional
|
||||
;;
|
||||
*)
|
||||
echo "'$1' not supported"
|
||||
echo "Usage: after.init {start|stop|flush-all|status}"
|
||||
;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
#
|
||||
# rules.input-after
|
||||
#
|
||||
# Rules that should be run after the ufw command line added rules. Custom
|
||||
# rules should be added to one of these chains:
|
||||
# ufw-after-input
|
||||
# ufw-after-output
|
||||
# ufw-after-forward
|
||||
#
|
||||
|
||||
# Don't delete these required lines, otherwise there will be errors
|
||||
*filter
|
||||
:ufw-after-input - [0:0]
|
||||
:ufw-after-output - [0:0]
|
||||
:ufw-after-forward - [0:0]
|
||||
# End required lines
|
||||
|
||||
# don't log noisy services by default
|
||||
-A ufw-after-input -p udp --dport 137 -j ufw-skip-to-policy-input
|
||||
-A ufw-after-input -p udp --dport 138 -j ufw-skip-to-policy-input
|
||||
-A ufw-after-input -p tcp --dport 139 -j ufw-skip-to-policy-input
|
||||
-A ufw-after-input -p tcp --dport 445 -j ufw-skip-to-policy-input
|
||||
-A ufw-after-input -p udp --dport 67 -j ufw-skip-to-policy-input
|
||||
-A ufw-after-input -p udp --dport 68 -j ufw-skip-to-policy-input
|
||||
|
||||
# don't log noisy broadcast
|
||||
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
|
||||
|
||||
# don't delete the 'COMMIT' line or these rules won't be processed
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
#
|
||||
# rules.input-after
|
||||
#
|
||||
# Rules that should be run after the ufw command line added rules. Custom
|
||||
# rules should be added to one of these chains:
|
||||
# ufw6-after-input
|
||||
# ufw6-after-output
|
||||
# ufw6-after-forward
|
||||
#
|
||||
|
||||
# Don't delete these required lines, otherwise there will be errors
|
||||
*filter
|
||||
:ufw6-after-input - [0:0]
|
||||
:ufw6-after-output - [0:0]
|
||||
:ufw6-after-forward - [0:0]
|
||||
# End required lines
|
||||
|
||||
# don't log noisy services by default
|
||||
-A ufw6-after-input -p udp --dport 137 -j ufw6-skip-to-policy-input
|
||||
-A ufw6-after-input -p udp --dport 138 -j ufw6-skip-to-policy-input
|
||||
-A ufw6-after-input -p tcp --dport 139 -j ufw6-skip-to-policy-input
|
||||
-A ufw6-after-input -p tcp --dport 445 -j ufw6-skip-to-policy-input
|
||||
-A ufw6-after-input -p udp --dport 546 -j ufw6-skip-to-policy-input
|
||||
-A ufw6-after-input -p udp --dport 547 -j ufw6-skip-to-policy-input
|
||||
|
||||
# don't delete the 'COMMIT' line or these rules won't be processed
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
[Nginx HTTP]
|
||||
title=Web Server (Nginx, HTTP)
|
||||
description=Small, but very powerful and efficient web server
|
||||
ports=80/tcp
|
||||
|
||||
[Nginx HTTPS]
|
||||
title=Web Server (Nginx, HTTPS)
|
||||
description=Small, but very powerful and efficient web server
|
||||
ports=443/tcp
|
||||
|
||||
[Nginx Full]
|
||||
title=Web Server (Nginx, HTTP + HTTPS)
|
||||
description=Small, but very powerful and efficient web server
|
||||
ports=80,443/tcp
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
[OpenSSH]
|
||||
title=Secure shell server, an rshd replacement
|
||||
description=OpenSSH is a free implementation of the Secure Shell protocol.
|
||||
ports=22/tcp
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
[Transmission]
|
||||
title=Transmission
|
||||
description=Transmission BitTorrent client
|
||||
ports=51413
|
||||
|
||||
[Deluge]
|
||||
title=Deluge
|
||||
description=Deluge BitTorrent client
|
||||
ports=6881:6891/tcp
|
||||
|
||||
[KTorrent]
|
||||
title=KTorrent
|
||||
description=KTorrent BitTorrent client
|
||||
ports=6881/tcp|4444/udp
|
||||
|
||||
[qBittorrent]
|
||||
title=qBittorrent
|
||||
description=qBittorrent BitTorrent client
|
||||
ports=6881/tcp
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
[PeopleNearby]
|
||||
title=People Nearby
|
||||
description=People Nearby (Bonjour/Salut) functionality in Empathy
|
||||
ports=5353/udp|5298
|
||||
|
||||
[Bonjour]
|
||||
title=Bonjour
|
||||
description=Bonjour protocol
|
||||
ports=5353/udp|5298
|
||||
|
||||
[MSN]
|
||||
title=MSN Chat
|
||||
description=MSN chat protocol (with file transfer and voice)
|
||||
ports=1863|6891:6900/tcp|6901
|
||||
|
||||
[MSN SSL]
|
||||
title=MSN Chat (SSL)
|
||||
description=MSN chat protocol (SSL)
|
||||
ports=443/tcp
|
||||
|
||||
[AIM]
|
||||
title=AIM Talk
|
||||
description=AIM talk protocol
|
||||
ports=5190/tcp
|
||||
|
||||
[Yahoo]
|
||||
title=Yahoo Chat
|
||||
description=Yahoo chat protocol
|
||||
ports=5050
|
||||
|
||||
[XMPP]
|
||||
title=XMPP Chat
|
||||
description=XMPP protocol (Jabber and Google Talk)
|
||||
ports=5222/tcp|5269/tcp
|
||||
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
[Kerberos KDC]
|
||||
title=Kerberos v5 KDC server
|
||||
description=Kerberos v5 KDC server
|
||||
ports=88
|
||||
|
||||
[Kerberos Admin]
|
||||
title=Kerberos v5 admin
|
||||
description=Kerberos v5 server
|
||||
ports=749/tcp
|
||||
|
||||
[Kerberos Password]
|
||||
title=Kerberos v5 password
|
||||
description=Kerberos v5 password
|
||||
ports=464/udp
|
||||
|
||||
[Kerberos Full]
|
||||
title=Kerberos v5 server
|
||||
description=Kerberos v5 server
|
||||
ports=88,749/tcp|464/udp
|
||||
|
||||
[LDAP]
|
||||
title=LDAP server
|
||||
description=LDAP server
|
||||
ports=389/tcp
|
||||
|
||||
[LDAPS]
|
||||
title=LDAP server (LDAPS)
|
||||
description=LDAP server (LDAPS)
|
||||
ports=636/tcp
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
[DNS]
|
||||
title=Internet Domain Name Server
|
||||
description=Internet Domain Name Server
|
||||
ports=53
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
[CIFS]
|
||||
title=SMB/CIFS server
|
||||
description=SMB/CIFS server
|
||||
ports=137,138/udp|139,445/tcp
|
||||
|
||||
[NFS]
|
||||
title=NFS server
|
||||
description=NFS and portmap server. Will also need access to mountd, statd and possibly others
|
||||
ports=2049,111/tcp|2049,111/udp
|
||||
|
||||
[svnserve]
|
||||
title=Subversion server
|
||||
description=Subversion server for access to Subversion repositories.
|
||||
ports=3690/tcp
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
[Telnet]
|
||||
title=Telnet server (insecure)
|
||||
description=Telnet server (insecure)
|
||||
ports=23/tcp
|
||||
|
||||
[SSH]
|
||||
title=SSH server
|
||||
description=SSH server
|
||||
ports=22/tcp
|
||||
|
||||
[VNC]
|
||||
title=VNC server
|
||||
description=VNC server
|
||||
ports=5900/tcp
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
[POP3]
|
||||
title=Mail server (POP3)
|
||||
description=Mail server (POP3)
|
||||
ports=110/tcp
|
||||
|
||||
[POP3S]
|
||||
title=Secure mail server (POP3S)
|
||||
description=Secure mail server (POP3S)
|
||||
ports=995/tcp
|
||||
|
||||
[IMAP]
|
||||
title=Mail server (IMAP)
|
||||
description=Mail server (IMAP)
|
||||
ports=143/tcp
|
||||
|
||||
[IMAPS]
|
||||
title=Secure mail server (IMAPS)
|
||||
description=Secure mail server (IMAPS)
|
||||
ports=993/tcp
|
||||
|
||||
[SMTP]
|
||||
title=Mail server (SMTP)
|
||||
description=Mail server (SMTP)
|
||||
ports=25/tcp
|
||||
|
||||
[Mail submission]
|
||||
title=Mail server (Submission)
|
||||
description=Mail server (Submission)
|
||||
ports=587/tcp
|
||||
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
[IPP]
|
||||
title=Cups server (IPP)
|
||||
description=Cups server (IPP)
|
||||
ports=631
|
||||
|
||||
[LPD]
|
||||
title=LPD server
|
||||
description=LPD server
|
||||
ports=515/tcp
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
[Socks]
|
||||
title=Socks proxy
|
||||
description=Socks proxy
|
||||
ports=1080/tcp
|
||||
|
||||
[Transparent Proxy]
|
||||
title=Transparent proxy
|
||||
description=Transparent proxy
|
||||
ports=8081/tcp
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
[WWW]
|
||||
title=Web Server
|
||||
description=Web server
|
||||
ports=80/tcp
|
||||
|
||||
[WWW Secure]
|
||||
title=Web Server (HTTPS)
|
||||
description=Web Server (HTTPS)
|
||||
ports=443/tcp
|
||||
|
||||
[WWW Full]
|
||||
title=Web Server (HTTP,HTTPS)
|
||||
description=Web Server (HTTP,HTTPS)
|
||||
ports=80,443/tcp
|
||||
|
||||
[WWW Cache]
|
||||
title=Web Server (8080)
|
||||
description=Web Server (8080)
|
||||
ports=8080/tcp
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
#!/bin/sh
|
||||
#
|
||||
# before.init: if executable, called by ufw-init. See 'man ufw-framework' for
|
||||
# details. Note that output from these scripts is not seen via the
|
||||
# the ufw command, but instead via ufw-init.
|
||||
#
|
||||
# Copyright 2013 Canonical Ltd.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License version 3,
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
# typically required
|
||||
;;
|
||||
stop)
|
||||
# typically required
|
||||
;;
|
||||
status)
|
||||
# optional
|
||||
;;
|
||||
flush-all)
|
||||
# optional
|
||||
;;
|
||||
*)
|
||||
echo "'$1' not supported"
|
||||
echo "Usage: before.init {start|stop|flush-all|status}"
|
||||
;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
#
|
||||
# rules.before
|
||||
#
|
||||
# Rules that should be run before the ufw command line added rules. Custom
|
||||
# rules should be added to one of these chains:
|
||||
# ufw-before-input
|
||||
# ufw-before-output
|
||||
# ufw-before-forward
|
||||
#
|
||||
|
||||
# Don't delete these required lines, otherwise there will be errors
|
||||
*filter
|
||||
:ufw-before-input - [0:0]
|
||||
:ufw-before-output - [0:0]
|
||||
:ufw-before-forward - [0:0]
|
||||
:ufw-not-local - [0:0]
|
||||
# End required lines
|
||||
|
||||
|
||||
# allow all on loopback
|
||||
-A ufw-before-input -i lo -j ACCEPT
|
||||
-A ufw-before-output -o lo -j ACCEPT
|
||||
|
||||
# quickly process packets for which we already have a connection
|
||||
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# drop INVALID packets (logs these in loglevel medium and higher)
|
||||
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
|
||||
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
|
||||
|
||||
# ok icmp codes for INPUT
|
||||
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
|
||||
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
|
||||
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
|
||||
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
|
||||
|
||||
# ok icmp code for FORWARD
|
||||
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
|
||||
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
|
||||
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
|
||||
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
|
||||
|
||||
# allow dhcp client to work
|
||||
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
|
||||
|
||||
#
|
||||
# ufw-not-local
|
||||
#
|
||||
-A ufw-before-input -j ufw-not-local
|
||||
|
||||
# if LOCAL, RETURN
|
||||
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
|
||||
|
||||
# if MULTICAST, RETURN
|
||||
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
|
||||
|
||||
# if BROADCAST, RETURN
|
||||
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
|
||||
|
||||
# all other non-local packets are dropped
|
||||
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
|
||||
-A ufw-not-local -j DROP
|
||||
|
||||
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
|
||||
# is uncommented)
|
||||
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
|
||||
|
||||
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
|
||||
# is uncommented)
|
||||
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
|
||||
|
||||
# don't delete the 'COMMIT' line or these rules won't be processed
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
#
|
||||
# rules.before
|
||||
#
|
||||
# Rules that should be run before the ufw command line added rules. Custom
|
||||
# rules should be added to one of these chains:
|
||||
# ufw6-before-input
|
||||
# ufw6-before-output
|
||||
# ufw6-before-forward
|
||||
#
|
||||
|
||||
# Don't delete these required lines, otherwise there will be errors
|
||||
*filter
|
||||
:ufw6-before-input - [0:0]
|
||||
:ufw6-before-output - [0:0]
|
||||
:ufw6-before-forward - [0:0]
|
||||
# End required lines
|
||||
|
||||
|
||||
# allow all on loopback
|
||||
-A ufw6-before-input -i lo -j ACCEPT
|
||||
-A ufw6-before-output -o lo -j ACCEPT
|
||||
|
||||
# drop packets with RH0 headers
|
||||
-A ufw6-before-input -m rt --rt-type 0 -j DROP
|
||||
-A ufw6-before-forward -m rt --rt-type 0 -j DROP
|
||||
-A ufw6-before-output -m rt --rt-type 0 -j DROP
|
||||
|
||||
# quickly process packets for which we already have a connection
|
||||
-A ufw6-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
-A ufw6-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
-A ufw6-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# multicast ping replies are part of the ok icmp codes for INPUT (rfc4890,
|
||||
# 4.4.1 and 4.4.2), but don't have an associated connection and are otherwise
|
||||
# be marked INVALID, so allow here instead.
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
||||
|
||||
# drop INVALID packets (logs these in loglevel medium and higher)
|
||||
-A ufw6-before-input -m conntrack --ctstate INVALID -j ufw6-logging-deny
|
||||
-A ufw6-before-input -m conntrack --ctstate INVALID -j DROP
|
||||
|
||||
# ok icmp codes for INPUT (rfc4890, 4.4.1 and 4.4.2)
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
|
||||
# codes 0 and 1
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
|
||||
# codes 0-2 (echo-reply needs to be before INVALID, see above)
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
|
||||
# IND solicitation
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
|
||||
# IND advertisement
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
|
||||
# MLD query
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
|
||||
# MLD report
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
|
||||
# MLD done
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
|
||||
# MLD report v2
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
|
||||
# SEND certificate path solicitation
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
|
||||
# SEND certificate path advertisement
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
|
||||
# MR advertisement
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
|
||||
# MR solicitation
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
|
||||
# MR termination
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
|
||||
|
||||
# ok icmp codes for OUTPUT (rfc4890, 4.4.1 and 4.4.2)
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
|
||||
# codes 0 and 1
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
|
||||
# codes 0-2
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
|
||||
# IND solicitation
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
|
||||
# IND advertisement
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
|
||||
# MLD query
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
|
||||
# MLD report
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
|
||||
# MLD done
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
|
||||
# MLD report v2
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
|
||||
# SEND certificate path solicitation
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
|
||||
# SEND certificate path advertisement
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
|
||||
# MR advertisement
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
|
||||
# MR solicitation
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
|
||||
# MR termination
|
||||
-A ufw6-before-output -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
|
||||
|
||||
# ok icmp codes for FORWARD (rfc4890, 4.3.1)
|
||||
-A ufw6-before-forward -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
|
||||
-A ufw6-before-forward -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
|
||||
# codes 0 and 1
|
||||
-A ufw6-before-forward -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
|
||||
# codes 0-2
|
||||
-A ufw6-before-forward -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
|
||||
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-request -j ACCEPT
|
||||
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
|
||||
# ok icmp codes for FORWARD (rfc4890, 4.3.2)
|
||||
# Home Agent Address Discovery Reques
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 144 -j ACCEPT
|
||||
# Home Agent Address Discovery Reply
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 145 -j ACCEPT
|
||||
# Mobile Prefix Solicitation
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 146 -j ACCEPT
|
||||
# Mobile Prefix Advertisement
|
||||
-A ufw6-before-input -p icmpv6 --icmpv6-type 147 -j ACCEPT
|
||||
|
||||
# allow dhcp client to work
|
||||
-A ufw6-before-input -p udp -s fe80::/10 --sport 547 -d fe80::/10 --dport 546 -j ACCEPT
|
||||
|
||||
# allow MULTICAST mDNS for service discovery
|
||||
-A ufw6-before-input -p udp -d ff02::fb --dport 5353 -j ACCEPT
|
||||
|
||||
# allow MULTICAST UPnP for service discovery
|
||||
-A ufw6-before-input -p udp -d ff02::f --dport 1900 -j ACCEPT
|
||||
|
||||
# don't delete the 'COMMIT' line or these rules won't be processed
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
#
|
||||
# Configuration file for setting network variables. Please note these settings
|
||||
# override /etc/sysctl.conf and /etc/sysctl.d. If you prefer to use
|
||||
# /etc/sysctl.conf, please adjust IPT_SYSCTL in /etc/default/ufw. See
|
||||
# Documentation/networking/ip-sysctl.txt in the kernel source code for more
|
||||
# information.
|
||||
#
|
||||
|
||||
# Uncomment this to allow this host to route packets between interfaces
|
||||
#net/ipv4/ip_forward=1
|
||||
#net/ipv6/conf/default/forwarding=1
|
||||
#net/ipv6/conf/all/forwarding=1
|
||||
|
||||
# Disable ICMP redirects. ICMP redirects are rarely used but can be used in
|
||||
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate
|
||||
# traffic to those sites.
|
||||
net/ipv4/conf/all/accept_redirects=0
|
||||
net/ipv4/conf/default/accept_redirects=0
|
||||
net/ipv6/conf/all/accept_redirects=0
|
||||
net/ipv6/conf/default/accept_redirects=0
|
||||
|
||||
# Ignore bogus ICMP errors
|
||||
net/ipv4/icmp_echo_ignore_broadcasts=1
|
||||
net/ipv4/icmp_ignore_bogus_error_responses=1
|
||||
net/ipv4/icmp_echo_ignore_all=0
|
||||
|
||||
# Don't log Martian Packets (impossible addresses)
|
||||
# packets
|
||||
net/ipv4/conf/all/log_martians=0
|
||||
net/ipv4/conf/default/log_martians=0
|
||||
|
||||
#net/ipv4/tcp_fin_timeout=30
|
||||
#net/ipv4/tcp_keepalive_intvl=1800
|
||||
|
||||
# Uncomment this to turn off ipv6 autoconfiguration
|
||||
#net/ipv6/conf/default/autoconf=1
|
||||
#net/ipv6/conf/all/autoconf=1
|
||||
|
||||
# Uncomment this to enable ipv6 privacy addressing
|
||||
#net/ipv6/conf/default/use_tempaddr=2
|
||||
#net/ipv6/conf/all/use_tempaddr=2
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
# /etc/ufw/ufw.conf
|
||||
#
|
||||
|
||||
# Set to yes to start on boot. If setting this remotely, be sure to add a rule
|
||||
# to allow your remote connection before starting ufw. Eg: 'ufw allow 22/tcp'
|
||||
ENABLED=yes
|
||||
|
||||
# Please use the 'ufw' command to set the loglevel. Eg: 'ufw logging medium'.
|
||||
# See 'man ufw' for details.
|
||||
LOGLEVEL=low
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
*filter
|
||||
:ufw-user-input - [0:0]
|
||||
:ufw-user-output - [0:0]
|
||||
:ufw-user-forward - [0:0]
|
||||
:ufw-before-logging-input - [0:0]
|
||||
:ufw-before-logging-output - [0:0]
|
||||
:ufw-before-logging-forward - [0:0]
|
||||
:ufw-user-logging-input - [0:0]
|
||||
:ufw-user-logging-output - [0:0]
|
||||
:ufw-user-logging-forward - [0:0]
|
||||
:ufw-after-logging-input - [0:0]
|
||||
:ufw-after-logging-output - [0:0]
|
||||
:ufw-after-logging-forward - [0:0]
|
||||
:ufw-logging-deny - [0:0]
|
||||
:ufw-logging-allow - [0:0]
|
||||
:ufw-user-limit - [0:0]
|
||||
:ufw-user-limit-accept - [0:0]
|
||||
### RULES ###
|
||||
|
||||
### tuple ### allow tcp 22 0.0.0.0/0 any 0.0.0.0/0 in
|
||||
-A ufw-user-input -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
### tuple ### allow tcp 80 0.0.0.0/0 any 0.0.0.0/0 in
|
||||
-A ufw-user-input -p tcp --dport 80 -j ACCEPT
|
||||
|
||||
### tuple ### allow any 443 0.0.0.0/0 any 0.0.0.0/0 in
|
||||
-A ufw-user-input -p tcp --dport 443 -j ACCEPT
|
||||
-A ufw-user-input -p udp --dport 443 -j ACCEPT
|
||||
|
||||
### tuple ### allow any any 0.0.0.0/0 any 172.16.254.11 in
|
||||
-A ufw-user-input -s 172.16.254.11 -j ACCEPT
|
||||
|
||||
### tuple ### allow any any 0.0.0.0/0 any 172.16.254.125 in
|
||||
-A ufw-user-input -s 172.16.254.125 -j ACCEPT
|
||||
|
||||
### tuple ### allow udp 443 0.0.0.0/0 any 0.0.0.0/0 in
|
||||
-A ufw-user-input -p udp --dport 443 -j ACCEPT
|
||||
|
||||
### tuple ### allow udp 80 0.0.0.0/0 any 0.0.0.0/0 in
|
||||
-A ufw-user-input -p udp --dport 80 -j ACCEPT
|
||||
|
||||
### tuple ### allow tcp 10051 0.0.0.0/0 any 0.0.0.0/0 in
|
||||
-A ufw-user-input -p tcp --dport 10051 -j ACCEPT
|
||||
|
||||
### END RULES ###
|
||||
|
||||
### LOGGING ###
|
||||
-A ufw-after-logging-forward -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
|
||||
-I ufw-logging-deny -m conntrack --ctstate INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
|
||||
-A ufw-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
|
||||
-A ufw-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
|
||||
### END LOGGING ###
|
||||
|
||||
### RATE LIMITING ###
|
||||
-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
|
||||
-A ufw-user-limit -j REJECT
|
||||
-A ufw-user-limit-accept -j ACCEPT
|
||||
### END RATE LIMITING ###
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
*filter
|
||||
:ufw6-user-input - [0:0]
|
||||
:ufw6-user-output - [0:0]
|
||||
:ufw6-user-forward - [0:0]
|
||||
:ufw6-before-logging-input - [0:0]
|
||||
:ufw6-before-logging-output - [0:0]
|
||||
:ufw6-before-logging-forward - [0:0]
|
||||
:ufw6-user-logging-input - [0:0]
|
||||
:ufw6-user-logging-output - [0:0]
|
||||
:ufw6-user-logging-forward - [0:0]
|
||||
:ufw6-after-logging-input - [0:0]
|
||||
:ufw6-after-logging-output - [0:0]
|
||||
:ufw6-after-logging-forward - [0:0]
|
||||
:ufw6-logging-deny - [0:0]
|
||||
:ufw6-logging-allow - [0:0]
|
||||
:ufw6-user-limit - [0:0]
|
||||
:ufw6-user-limit-accept - [0:0]
|
||||
### RULES ###
|
||||
|
||||
### tuple ### allow tcp 22 ::/0 any ::/0 in
|
||||
-A ufw6-user-input -p tcp --dport 22 -j ACCEPT
|
||||
|
||||
### tuple ### allow tcp 80 ::/0 any ::/0 in
|
||||
-A ufw6-user-input -p tcp --dport 80 -j ACCEPT
|
||||
|
||||
### tuple ### allow any 443 ::/0 any ::/0 in
|
||||
-A ufw6-user-input -p tcp --dport 443 -j ACCEPT
|
||||
-A ufw6-user-input -p udp --dport 443 -j ACCEPT
|
||||
|
||||
### tuple ### allow udp 443 ::/0 any ::/0 in
|
||||
-A ufw6-user-input -p udp --dport 443 -j ACCEPT
|
||||
|
||||
### tuple ### allow udp 80 ::/0 any ::/0 in
|
||||
-A ufw6-user-input -p udp --dport 80 -j ACCEPT
|
||||
|
||||
### tuple ### allow tcp 10051 ::/0 any ::/0 in
|
||||
-A ufw6-user-input -p tcp --dport 10051 -j ACCEPT
|
||||
|
||||
### END RULES ###
|
||||
|
||||
### LOGGING ###
|
||||
-A ufw6-after-logging-forward -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
|
||||
-I ufw6-logging-deny -m conntrack --ctstate INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
|
||||
-A ufw6-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
|
||||
-A ufw6-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
|
||||
### END LOGGING ###
|
||||
|
||||
### RATE LIMITING ###
|
||||
-A ufw6-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
|
||||
-A ufw6-user-limit -j REJECT
|
||||
-A ufw6-user-limit-accept -j ACCEPT
|
||||
### END RATE LIMITING ###
|
||||
COMMIT
|
||||
Loading…
Reference in New Issue