Minimal iptables for rancher 2 agent/kubernetes

rules.v4

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Masquerading all outgoing routet traffic
-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

*filter
:INPUT DROP [10518:47789289]
:FORWARD ACCEPT [6:345]
:OUTPUT ACCEPT [9713:1032463]

# Cleanup
-F INPUT
# Allow traffic of existing connections
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow all traffic from localhost
-A INPUT -i lo -j ACCEPT
# Allow ICMP
-A INPUT -p icmp -j ACCEPT


# Allow SSH
-A INPUT -p tcp --dport 22 -j ACCEPT
# Allow HTTP
-A INPUT -p tcp --dport 80 -j ACCEPT
# Allow HTTPS
-A INPUT -p tcp --dport 443 -j ACCEPT
# Allow wireguard
-A INPUT -p tcp --dport 51820 -j ACCEPT
# Allow rancher server
-A INPUT -p tcp --dport 8443 -j ACCEPT

COMMIT

rules.v6

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT