dustin/configpolicy
1
1
Fork 0
Code Issues Releases Activity

dch-gw: Restrict traffic from Management network

Browse Source 
Traffic from the management network is not allowed except for specific
services. NTP is required of course, for time synchronization with the
pyrocufflink.blue domain controllers. RADIUS is necessary for WiFi
authentication, which is also handled by the DCs.
This commit is contained in:
Dustin
2018-07-15 12:16:43 -05:00
parent d6b4e4a098
commit c88ee8bd99
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
roles/dch-gw/templates/forward.nft.j2
View File

@@ -1,5 +1,13 @@
{#- vim: set sw=4 ts=4 sts=4 et : #}
table inet filter {
set domain_controllers {
type ipv4_addr
elements = {
dc0.pyrocufflink.blue,
dc1.pyrocufflink.blue,
}
}
set vpn_subnets {
type ipv4_addr
flags interval
@@ -15,6 +23,8 @@ table inet filter {
ct state established,related accept
iifname {{ dch_networks.guest.router_iface }} oif != {{ internet_iface }} drop
iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop
iifname {{ dch_networks.mgmt.router_iface }} ip daddr @domain_controllers udp dport { ntp, radius } counter accept
iifname {{ dch_networks.mgmt.router_iface }} counter drop
iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept
iif {{ internet_iface }} ip saddr @vpn_subnets counter accept
iif != {{ internet_iface }} ip daddr @vpn_subnets counter accept