dustin
/
configpolicy
1
1
Fork 0
Code Issues Releases Activity

dch-gw: Restrict traffic from Management network 

Traffic from the management network is not allowed except for specific
services. NTP is required of course, for time synchronization with the
pyrocufflink.blue domain controllers. RADIUS is necessary for WiFi
authentication, which is also handled by the DCs.
jenkins-master
Dustin 2018-07-15 12:16:43 -05:00
parent d6b4e4a098
commit c88ee8bd99
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
roles/dch-gw/templates/forward.nft.j2
View File

@ -1,5 +1,13 @@
{#- vim: set sw=4 ts=4 sts=4 et : #}
table inet filter {
set domain_controllers {
type ipv4_addr
elements = {
dc0.pyrocufflink.blue,
dc1.pyrocufflink.blue,
}
}
set vpn_subnets {
type ipv4_addr
flags interval
@ -15,6 +23,8 @@ table inet filter {
ct state established,related accept
iifname {{ dch_networks.guest.router_iface }} oif != {{ internet_iface }} drop
iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop
iifname {{ dch_networks.mgmt.router_iface }} ip daddr @domain_controllers udp dport { ntp, radius } counter accept
iifname {{ dch_networks.mgmt.router_iface }} counter drop
iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept
iif {{ internet_iface }} ip saddr @vpn_subnets counter accept
iif != {{ internet_iface }} ip daddr @vpn_subnets counter accept