iptables.sls

iptables:
  pkg.latest:
    - pkgs:
      - iptables
      - iptables-persistent
    - refresh: True
    - reload_modules: True

# IPv4

iptables-ipv4-allow-loopback-traffic:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: INPUT
    - i: lo
    - jump: ACCEPT
    - save: True
    - require:
      - pkg: iptables

iptables-ipv4-drop-loopback-traffic-not-using-lo0:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: INPUT
    - i: '! lo'
    - source: 127.0.0.1/8
    - jump: REJECT
    - save: True
    - require:
      - pkg: iptables

iptables-ipv4-allow-icmp:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: INPUT
    - proto: icmp
    - jump: ACCEPT
    - save: True
    - require:
      - pkg: iptables

iptables-ipv4-allow-ssh:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: INPUT
    - proto: tcp
    - dport: 22
    - match: state
    - connstate: NEW
    - jump: ACCEPT
    - save: True
    - require:
      - pkg: iptables

iptables-ipv4-allow-established-inbound:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: INPUT
    - match: state
    - connstate: ESTABLISHED,RELATED
    - jump: ACCEPT
    - save: True
    - require:
      - pkg: iptables

iptables-ipv4-reject-inbound-traffic:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: INPUT
    - jump: REJECT
    - require:
      - iptables: iptables-ipv4-allow-loopback-traffic
      - iptables: iptables-ipv4-drop-loopback-traffic-not-using-lo0
      - iptables: iptables-ipv4-allow-established-inbound

iptables-ipv4-reject-forward-traffic:
  iptables.append:
    - table: filter
    - family: ipv4
    - chain: FORWARD
    - jump: REJECT
    - require:
      - iptables: iptables-ipv4-allow-loopback-traffic
      - iptables: iptables-ipv4-drop-loopback-traffic-not-using-lo0
      - iptables: iptables-ipv4-allow-established-inbound