Use ipset for blacklists and whitelists

iptables/README.md

@@ -1,16 +1,24 @@
-# Iptables
+# iptables & ipset
 
 ```sh
-sudo cp *.rules /etc
+sudo apt install ipset
+```
+
+```sh
+sudo cp empty.rules /etc
+sudo touch /etc/{default,ipset}.rules
 sudo cp *.service /etc/systemd/system
-sudo systemctl enable iptables
+sudo systemctl enable iptables ipset
+sudo systemctl start iptables ipset
 ```
 
-## Apply and Report Rate Limits
-
-The `ratelimit.rules` file adds new chains to
-limit the rate of new connections based on /16 subnets.
+## Presets
 
 ```sh
-sudo iptables-restore -n < ratelimit.rules
+sudo ipset restore -f ipset.rules
+sudo iptables-restore -n connection.rules
+sudo iptables-restore -n service.rules
+sudo iptables-restore -n blackwhite.rules
+sudo iptables-restore -n knock.rules
+sudo iptables-restore -n ratelimit.rules
 ```

iptables/blackwhite.rules

@@ -0,0 +1,13 @@
+*raw
+:BLACKLIST -
+:WHITELIST -
+
+-A PREROUTING -j WHITELIST
+-A PREROUTING -j BLACKLIST
+
+-A BLACKLIST -m set --match-set blacklist src -j DROP
+
+-A WHITELIST -m set --match-set local src -j ACCEPT
+-A WHITELIST -m set --match-set whitelist src -j ACCEPT
+
+COMMIT

iptables/connection.rules

@@ -0,0 +1,6 @@
+*filter
+:CONNECTION -
+-A INPUT -j CONNECTION
+-A CONNECTION -i lo -j ACCEPT
+-A CONNECTION -m state --state RELATED,ESTABLISHED -j ACCEPT
+COMMIT

iptables/ipset.rules

@@ -0,0 +1,8 @@
+create local hash:net
+create whitelist hash:net
+create blacklist hash:net
+
+add local 127.0.0.0/8
+add local 10.0.0.0/8
+add local 172.16.0.0/12
+add local 192.168.0.0/16

iptables/ipset.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=ipset
+Before=network-pre.target iptables.service
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=ipset restore -f /etc/ipset.rules
+ExecStop=ipset save -f /etc/ipset.rules ; ipset destroy
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

iptables/iptables.service

@@ -5,8 +5,8 @@ Wants=network-pre.target
 
 [Service]
 Type=oneshot
-ExecStart=iptables-restore /etc/default.rules
-ExecStop=iptables-restore /etc/empty.rules
+ExecStart=iptables-restore -c /etc/default.rules
+ExecStop=iptables-save -c -f /etc/default.rules ; iptables-restore /etc/empty.rules
 RemainAfterExit=yes
 
 [Install]

iptables/knock.rules

@@ -0,0 +1,10 @@
+*raw
+:KNOCK -
+
+-A PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK SYN -j KNOCK
+
+-A KNOCK -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 30 --reap --name SSHOK -j RETURN
+-A KNOCK -p tcp -m tcp --dport 22222 -m recent --set --name SSHOK -j DROP
+-A KNOCK -p tcp -m tcp --dport 22 -j DROP
+
+COMMIT

iptables/ratelimit.rules

@@ -1,23 +1,10 @@
 *raw
-:BLOCK -
 :RATELIMIT -
-:WHITELIST -
 
--A PREROUTING -j WHITELIST
--A PREROUTING -j BLOCK
 -A PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK SYN -j RATELIMIT
 
--A BLOCK -s 46.229.160.0/20 -m comment --comment SEMrushBot -j DROP
--A BLOCK -s 114.119.160.0/21 -m comment --comment AspiegelBot -j DROP
-
--A RATELIMIT -p tcp -m tcp --dport 22222 -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 2 --hashlimit-mode srcip --hashlimit-name ratelimit-ssh --hashlimit-srcmask 16 -j DROP
 -A RATELIMIT -p tcp -m tcp --dport 25 -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name ratelimit-smtp --hashlimit-srcmask 16 -j DROP
 -A RATELIMIT -p tcp -m tcp --dport 143 -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name ratelimit-imap --hashlimit-srcmask 16 -j DROP
 -A RATELIMIT -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 16 --hashlimit-mode srcip,dstport --hashlimit-name ratelimit-other --hashlimit-srcmask 16 -j DROP
 
--A WHITELIST -s 127.0.0.0/8 -m comment --comment localhost -j ACCEPT
--A WHITELIST -s 10.0.0.0/8 -m comment --comment "RFC 1918" -j ACCEPT
--A WHITELIST -s 172.16.0.0/12 -m comment --comment "RFC 1918" -j ACCEPT
--A WHITELIST -s 192.168.0.0/16 -m comment --comment "RFC 1918" -j ACCEPT
-
 COMMIT

iptables/service.rules

@@ -1,15 +1,11 @@
 *filter
 :INPUT DROP
-:CONNECTION -
 :SERVICE -
--A INPUT -j CONNECTION
 -A INPUT -j SERVICE
--A CONNECTION -i lo -j ACCEPT
--A CONNECTION -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A SERVICE -p tcp --dport 22 -j ACCEPT
 -A SERVICE -p tcp --dport 25 -j ACCEPT
 -A SERVICE -p tcp --dport 80 -j ACCEPT
 -A SERVICE -p tcp --dport 143 -j ACCEPT
 -A SERVICE -p tcp --dport 443 -j ACCEPT
--A SERVICE -p tcp --dport 22222 -j ACCEPT
 -A SERVICE -p udp --dport 53 -j ACCEPT
 COMMIT

ssh/sshd_config

@@ -1,9 +1,7 @@
 UseDNS no
-Port 22222
 AllowUsers sshlogin git backup-*
 ClientAliveInterval 10
 
-LoginGraceTime 10
 MaxAuthTries 2
 
 Match User backup-*