ansible/roles/iptables/gluster6.j2

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

# =============
# Gluster
# =============
:gluster_in - [0:0]
# Rate-limits
-A gluster_in -m hashlimit --hashlimit-mode srcip --hashlimit-name gluster --hashlimit-above 1/sec --hashlimit-burst 25 -j DROP
# AWS gluster subnets
-A gluster_in -s 2600:1f14:6b8:9101::/64 -j ACCEPT
-A gluster_in -s 2600:1f14:6b8:9102::/64 -j ACCEPT
# Workstations
-A gluster_in -s 2600:1f14:6b8:9103::/64 -j ACCEPT
# Backend
-A gluster_in -s 2600:1f14:6b8:9107::/64 -j ACCEPT
-A gluster_in -s 2600:1f14:6b8:9108::/64 -j ACCEPT
# Logging
#-A gluster_in -j LOG --log-prefix "gluster_in: "
-A gluster_in -j RETURN

# =============
# INPUT
# =============
# Established connections
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Loopback
-A INPUT -s ::1 -d ::1 -i lo -j ACCEPT
# ICMP
-A INPUT -p icmpv6 -m hashlimit --hashlimit-mode srcip --hashlimit-name icmp --hashlimit-upto 2/s --hashlimit-burst 25 -j ACCEPT
-A INPUT -p icmpv6 -j DROP
# SSH
-A INPUT -p tcp -m tcp --dport 22 -m hashlimit --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-upto 1/s --hashlimit-burst 5 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP
# Gluster
-A INPUT -p tcp -m multiport --dports 111,24007,49152:49159 -j gluster_in
-A INPUT -p udp -m multiport --dports 111 -j gluster_in
# Logging
#-A INPUT -j LOG --log-prefix "INPUT: "

# =============
# OUTPUT
# =============
# Established connections
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Loopback
-A OUTPUT -s ::1 -d ::1 -o lo -j ACCEPT
# Everything else
-A OUTPUT -j ACCEPT
COMMIT