sjat
b10a33f439
base__firewall_input_only renders the forward chain policy accept (host-local INPUT filtering only) for hosts that forward container/NAT traffic; defaults false so real service hosts keep the forward default-deny. base__firewall_admin_addrs adds operator-workstation LAN sources to the SSH allow-list alongside wt0 + ssh-from-control. Molecule locks the secure default + the admin rule. Mesh-hardening 2/3 (ADR-020/021). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
28 lines
1.1 KiB
Django/Jinja
28 lines
1.1 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
# Ansible managed — do not edit by hand. Source: roles/base (ADR-020).
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
iifname "lo" accept
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
iifname "{{ base__firewall_mgmt_interface }}" tcp dport {{ base__firewall_ssh_port }} accept
|
|
{% if base__firewall_control_addr %}
|
|
ip saddr {{ base__firewall_control_addr }} tcp dport {{ base__firewall_ssh_port }} accept
|
|
{% endif %}
|
|
{% for addr in base__firewall_admin_addrs %}
|
|
ip saddr {{ addr }} tcp dport {{ base__firewall_ssh_port }} accept
|
|
{% endfor %}
|
|
ip protocol icmp accept
|
|
ip6 nexthdr ipv6-icmp accept
|
|
{% for r in base__firewall_resolved %}
|
|
ip saddr { {{ r.sources | join(', ') }} } {{ r.proto }} dport {{ r.port }} accept
|
|
{% endfor %}
|
|
}
|
|
chain forward { type filter hook forward priority 0; policy {{ 'accept' if base__firewall_input_only | bool else 'drop' }}; }
|
|
chain output { type filter hook output priority 0; policy accept; }
|
|
}
|
|
|
|
include "{{ base__firewall_dropin_dir }}/*.nft"
|