107 lines
5.1 KiB
Bash
107 lines
5.1 KiB
Bash
#!/bin/bash
|
|
# ═══════════════════════════════════════════════════════════════════
|
|
# Firewall monitoring-uber (185.103.167.138)
|
|
# ─────────────────────────────────────────────────────────────────
|
|
# INBOUND:
|
|
# • 1514/tcp FROM prod (185.103.166.119) — agents Wazuh
|
|
# • 1514/tcp FROM pre-prod (185.103.166.112) — agents Wazuh
|
|
# • 51820/udp — VPN WireGuard
|
|
# • 10.0.0.0/24 (VPN admins) → 443, 8080, 8090, 9000, 9001
|
|
# • SSH: BLOCKED from prod/pre-prod/s3 (security hardening)
|
|
# ─────────────────────────────────────────────────────────────────
|
|
# OUTBOUND:
|
|
# • Tout (0.0.0.0/0) — Internet, updates, DNS
|
|
# • VPN vers VPS
|
|
# ═══════════════════════════════════════════════════════════════════
|
|
|
|
set -e
|
|
|
|
echo "[*] Configurant firewall monitoring-uber..."
|
|
|
|
# Flush des règles existantes
|
|
iptables -F
|
|
iptables -X
|
|
iptables -t nat -F
|
|
iptables -t nat -X
|
|
iptables -t mangle -F
|
|
iptables -t mangle -X
|
|
|
|
# Politique par défaut
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
# ─── INPUT ────────────────────────────────────────────────────────
|
|
# Loopback (services internes)
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
|
|
# Established/Related
|
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# SSH (administration locale, bloquer depuis prod/pre-prod/s3)
|
|
iptables -A INPUT -p tcp --dport 22 -s 185.103.166.119 -j DROP # prod
|
|
iptables -A INPUT -p tcp --dport 22 -s 185.103.166.112 -j DROP # pre-prod
|
|
iptables -A INPUT -p tcp --dport 22 -s 80.96.58.164 -j DROP # s3
|
|
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allow from other sources
|
|
|
|
# ─── Agents Wazuh (prod + pre-prod) ────────────────────────────
|
|
# Prod: 185.103.166.119
|
|
iptables -A INPUT -p tcp --dport 1514 -s 185.103.166.119 -j ACCEPT
|
|
|
|
# Pre-prod: 185.103.166.112
|
|
iptables -A INPUT -p tcp --dport 1514 -s 185.103.166.112 -j ACCEPT
|
|
|
|
# ─── VPN (WireGuard) ──────────────────────────────────────────
|
|
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
|
|
|
|
# ─── Services (accessibles via VPN seulement) ─────────────────
|
|
# Admins via VPN: 10.0.0.0/24
|
|
|
|
# Wazuh Dashboard (443/https)
|
|
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
|
|
|
|
# Dozzle (8080/http)
|
|
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
|
|
|
|
# Beszel (8090/http)
|
|
iptables -A INPUT -p tcp --dport 8090 -s 10.0.0.0/24 -j ACCEPT
|
|
|
|
# S3/RustFS (9000/9001)
|
|
iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/24 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 9001 -s 10.0.0.0/24 -j ACCEPT
|
|
|
|
# ─── ICMP ─────────────────────────────────────────────────────
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
|
|
|
|
# Reject le reste
|
|
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
|
|
|
|
# ─── FORWARD ──────────────────────────────────────────────────
|
|
# Blocker forward par défaut (services locaux, pas de transit)
|
|
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
|
|
|
|
# ─── Sauvegarder ──────────────────────────────────────────────
|
|
mkdir -p /etc/iptables
|
|
iptables-save > /etc/iptables/rules.v4
|
|
|
|
echo "[✓] Firewall monitoring-uber configuré"
|
|
echo ""
|
|
echo "Règles appliquées (ALLOW) :"
|
|
echo " • SSH 22/tcp — from admin IPs only (BLOCKED from prod/pre-prod/s3)"
|
|
echo " • Wazuh 1514/tcp FROM prod (185.103.166.119) — agents Wazuh"
|
|
echo " • Wazuh 1514/tcp FROM pre-prod (185.103.166.112) — agents Wazuh"
|
|
echo " • VPN 51820/udp — WireGuard"
|
|
echo " • Wazuh Dashboard 443/tcp FROM 10.0.0.0/24 (VPN)"
|
|
echo " • Dozzle 8080/tcp FROM 10.0.0.0/24 (VPN)"
|
|
echo " • Beszel 8090/tcp FROM 10.0.0.0/24 (VPN)"
|
|
echo " • S3/RustFS 9000-9001/tcp FROM 10.0.0.0/24 (VPN)"
|
|
echo " • OUTPUT (Internet/DNS)"
|
|
echo ""
|
|
echo "Règles appliquées (DENY) :"
|
|
echo " • SSH 22/tcp FROM prod (185.103.166.119) — BLOCKED"
|
|
echo " • SSH 22/tcp FROM pre-prod (185.103.166.112) — BLOCKED"
|
|
echo " • SSH 22/tcp FROM s3 (80.96.58.164) — BLOCKED"
|
|
echo " • All other INPUT/FORWARD — default DROP"
|