# Host Firewall rules

We want to enforce iptables rules on all servers fleet, including on the ones behind a corporate firewall (and so using NAT for outgoing connections and/or DNAT for incoming ones)

## Baseline

The [ansible-role-iptables](https://github.com/centos/ansible-role-iptables) is one of the few roles that isn't applied through a group membership at the ansible inventory level, but is deployed/imported in our [baseline](https://github.com/CentOS/ansible-role-baseline/blob/master/tasks/main.yml#L149) (see the `import_role` task to import iptables rules)

The basic iptables role would (both for ipv4 and ipv6): 

 * only allow sshd (tcp/22) from some known bastion hosts

 * create an iptables rules for `ipset` (centos-blocked-manual)

 * install ipset service

 * block all the rest

It creates a skeleton of other rules to be assembled by iptables (see `/etc/sysconfig/iptables.d`) to be then reloaded.

That means that from there, any other ansible role would just have to drop his iptables rules file , assemble new config file and reload.

One example is from `baseline` role itself, importing [zabbix-agent](https://github.com/CentOS/ansible-role-zabbix-agent) : 

```

- name: Configuring iptables rules

  include_role:

    name: iptables

    tasks_from: custom-policy

  vars:

    iptables_policy_name: zabbix-agent

    iptables_protocol: tcp

    iptables_port: "10050"

    iptables_source: "{{ zabbix_server_ip }}"

  tags:

    - iptables

```

As you can see, the zabbix-agent role, is just importing the `custom-policy.yml` tasks from iptables role, with some variables (in our case, mentioning that we only accept traffic from zabbix server on tcp/10050 on the agent side). It's quite modular and other roles follow the same principles (usually). Behind the scene that means that :

  * it's creating the /etc/sysconfig/iptables.d/01-input-service-policy-zabbix-agent (from jinja2 ansible template)

  * using the `assemble` ansible module to concat all snippet files under /etc/sysconfig/iptables.d/

  * restarting iptables with new ruleset

## Custom rules (including NAT/DNAT)

Probably better to read the [defaults/main.yml](https://github.com/CentOS/ansible-role-iptables/blob/master/defaults/main.yml) to see other features that you can apply with the iptables rules but there are some other features (speicific to host/group variables and not `role` bound :

Defining custom local rules (empty by default):

```

iptables_local_input_rules:

  - source: 192.168.0.0/24

    dport: 80

    protocol: tcp

  - dport: 25  # would open for all tcp/25  

```

Should the node be used as gateway/router/firewall itself, we can control that through the following variables (see the main.yml files for examples :

  * iptables_gw (boolean, default is False)

  * iptables_forward_allow

  * iptables_nat_postrouting_allow

  * iptables_nat_prerouting_allow

  * iptables_redirects (local port)

## Ipset

One of the main advantage with [ipset](https://ipset.netfilter.org/) is that if you need to add a *lot* of hosts in a deny list (either for DROP or REJECT rules) , it's faster to just use ipset in memory than iptables rules for all these IP addresses. That means that you can just create one (or mutiple) iptables rules just pointing to ipset rules.

As said above, our basic iptables rule would at least create one iptable rule pointing to the `centos-blocked-manual` ipset list (empty), but that means that adding an ip directly into ipset would work without having to reload the whole iptables service/ruleset (`ipset add blocked-centos-manual $ip`)

We also can use/update some public lists from services like  [Firehol.org](http://iplists.firehol.org/).

See again the `defaults/main.yml` iptables file to see some example but by default `ipset_block_lists` is empty and so not using any of these lists