1
0
mirror of https://github.com/billz/raspap-webgui.git synced 2023-10-10 13:37:24 +02:00
raspap-webgui/config/iptables_rules.json
2021-07-25 15:42:46 +02:00

206 lines
6.9 KiB
JSON

{
"info": "IPTABLES rules. $...$ expressions will be replaces automatically ($INTERFACE$, $PORT$, $IPADDRESS$)",
"rules_v4_file": "/etc/iptables/rules.v4",
"rules_v6_file": "/etc/iptables/rules.v6",
"order": [ "pre_rules", "restriction_rules", "main_rules", "exception_rules" ],
"pre_rules": [
{
"name": "firewall policies",
"fw-state": true,
"comment": "Policy rules (firewall)",
"rules": [
"-P INPUT DROP",
"-P FORWARD ACCEPT",
"-P OUTPUT ACCEPT",
"-t nat -P PREROUTING ACCEPT",
"-t nat -P POSTROUTING ACCEPT",
"-t nat -P INPUT ACCEPT",
"-t nat -P OUTPUT ACCEPT"
]
},
{
"name": "policies",
"fw-state": false,
"comment": "Policy rules",
"rules": [
"-P INPUT ACCEPT",
"-P FORWARD ACCEPT",
"-P OUTPUT ACCEPT",
"-t nat -P PREROUTING ACCEPT",
"-t nat -P POSTROUTING ACCEPT",
"-t nat -P INPUT ACCEPT",
"-t nat -P OUTPUT ACCEPT"
]
},
{
"name": "loopback",
"fw-state": true,
"comment": "allow loopback device",
"rules": [
"-A INPUT -i lo -j ACCEPT",
"-A OUTPUT -o lo -j ACCEPT"
]
},
{
"name": "ping",
"fw-state": true,
"ip-version": 4,
"comment": "allow ping request and echo",
"rules": [
"-A INPUT -p icmp --icmp-type 8/0 -j ACCEPT",
"-A INPUT -p icmp --icmp-type 0/0 -j ACCEPT"
]
},
{
"name": "ping IPv6",
"fw-state": true,
"ip-version": 6,
"comment": "allow ping request and echo for IPv6",
"rules": [
"-A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT",
"-A INPUT -p icmpv6 --icmpv6-type echo-reply -j ACCEPT"
]
},
{
"name": "ntp",
"fw-state": true,
"comment": "allow ntp request via udp (tcp should work w/o rule)",
"rules": [
"-A INPUT -p udp --sport 123 -j ACCEPT"
]
},
{
"name": "dns",
"fw-state": true,
"comment": "allow dns request via tcp and udp",
"rules": [
"-A INPUT -p udp -m multiport --sport 53,853 -j ACCEPT",
"-A INPUT -p tcp -m multiport --sport 53,853 -j ACCEPT"
]
}
],
"main_rules": [
{
"name": "accesspoint",
"fw-state": true,
"comment": "Access point interface by default no restrictions",
"dependson": [
{ "var": "ap-device", "type": "string", "replace": "$INTERFACE$" }
],
"rules": [
"-A INPUT -i $INTERFACE$ -j ACCEPT",
"-A OUTPUT -o $INTERFACE$ -j ACCEPT"
]
},
{
"name": "NAT for access point",
"comment": "Masquerading needed for access point",
"rules": [
"-t nat -A POSTROUTING -j MASQUERADE"
]
},
{
"name": "clients",
"fw-state": true,
"comment": "Rules for client interfaces (includes tun device)",
"rules": [
"-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT"
]
},
{
"name": "openvpn",
"comment": "Rules for tunnel device (tun)",
"ip-version": 4,
"dependson": [
{ "var": "openvpn-enable", "type": "bool" },
{ "var": "openvpn-serverip", "type": "string", "replace": "$IPADDRESS$" },
{ "var": "ap-device", "type": "string", "replace": "$INTERFACE$" }
],
"rules": [
"-A INPUT -p udp -s $IPADDRESS$ -j ACCEPT",
"-A FORWARD -i tun+ -o $INTERFACE$ -m state --state RELATED,ESTABLISHED -j ACCEPT",
"-A FORWARD -i $INTERFACE$ -o tun+ -j ACCEPT",
"-t nat -A POSTROUTING -o tun+ -j MASQUERADE"
]
},
{
"name": "wireguard",
"comment": "Rules for wireguard device (wg)",
"ip-version": 4,
"dependson": [
{ "var": "wireguard-enable", "type": "bool" },
{ "var": "wireguard-serverip", "type": "string", "replace": "$IPADDRESS$" },
{ "var": "client-device", "type": "string", "replace": "$INTERFACE$" }
],
"rules": [
"-A INPUT -p udp -s $IPADDRESS$ -j ACCEPT",
"-A FORWARD -i wg+ -j ACCEPT",
"-t nat -A POSTROUTING -o $INTERFACE$ -j MASQUERADE"
]
}
],
"exception_rules": [
{
"name": "ssh",
"fw-state": true,
"comment": "Allow ssh access to RaspAP on port 22",
"dependson": [
{ "var": "ssh-enable", "type": "bool" }
],
"rules": [
"-A INPUT -p tcp --dport 22 -j ACCEPT"
]
},
{
"name": "http",
"fw-state": true,
"comment": "Allow access to RaspAP GUI (https)",
"dependson": [
{ "var": "http-enable", "type": "bool" }
],
"rules": [
"-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT"
]
},
{
"name": "interface",
"fw-state": true,
"comment": "Exclude interface from firewall",
"dependson": [
{ "var": "excl-devices", "type": "list", "replace": "$INTERFACE$" }
],
"rules": [
"-A INPUT -i $INTERFACE$ -j ACCEPT",
"-A OUTPUT -o $INTERFACE$ -j ACCEPT"
]
},
{
"name": "ipaddress",
"fw-state": true,
"ip-version": 4,
"comment": "allow access from/to IP",
"dependson": [
{ "var": "excluded-ips", "type": "list", "replace": "$IPADDRESS$" }
],
"rules": [
"-A INPUT -s $IPADDRESS$ -j ACCEPT",
"-A INPUT -d $IPADDRESS$ -j ACCEPT"
]
}
],
"restriction_rules": [
{
"name": "ipaddress",
"fw-state": true,
"ip-version": 4,
"dependson": [
{ "var": "restricted-ips", "type": "list", "replace": "$IPADDRESS$" }
],
"comment": "Block access from IP-address",
"rules": [
"-A INPUT -s $IPADDRESS$ -j DROP"
]
}
]
}