Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
#cloud-config
write_files:
- path: /var/lib/iptables/rules-save
permissions: 0644
owner: root:root
content: |
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -m limit --limit 1/sec -j LOG --log-prefix "[IPTABLES INPUT] : "
-A INPUT -j DROP
-A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "[IPTABLES FORWARD] : "
-A FORWARD -j DROP
COMMIT
coreos:
units:
- name: static.network
content: |
[Match]
Name=eth0
[Network]
Address=${ADRESS}
Gateway=${GATEWAY}
DNS=${DNS1}
DNS=${DNS2}
- name: timezone.service
command: start
content: |
[Unit]
Description=timezone
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/ln -sf ../usr/share/zoneinfo/Japan /etc/localtime
- name: iptables.service
command: start
content: |
[Unit]
Description=Packet Filtering Framework
DefaultDependencies=no
After=systemd-sysctl.service
Before=sysinit.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/iptables-restore /var/lib/iptables/rules-save
ExecReload=/usr/sbin/iptables-restore /var/lib/iptables/rules-save
ExecStop=/usr/sbin/iptables --flush
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
users:
- name: core
ssh-authorized-keys:
- ssh-rsa ${PUBLIC_KEY}
groups:
- sudo
- docker
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.