Ciao a tutti,
questo è il mio primo post qui. Il mio background: amministro server Linux da oltre un decennio. Circa una settimana fa ho eseguito un’installazione di Discourse su un server (Debian Bullseye). Mi piace finora, ottimo!
Ora volevo implementare le solite misure di hardening sul sistema host (ad es. webserver). Questo include, tra le altre cose, regole nftables. Generalmente uso queste:
#!/usr/sbin/nft -f
####################
# Purge/Flush #
####################
flush ruleset
####################
# Incoming Traffic #
####################
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
# Allow loopback interface
iifname lo accept
# Rate limit ICMPv4|ICMPv6 traffic
ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded, parameter-problem, router-solicitation, router-advertisement } limit rate over 5/second drop
ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, parameter-problem, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } limit rate over 5/second drop
# Allow packets to established/related connections
ct state established,related accept
# Drop invalid connections
ct state invalid drop
# Allow ICMPv4: Ping requests | Error messages | Router selection messages
ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded, parameter-problem, router-solicitation, router-advertisement } accept
# Allow ICMPv6 traffic (https://tools.ietf.org/html/rfc4890#page-18)
ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, parameter-problem, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept
# Allow SSH access on port 2222 [rate limit]
tcp dport 2222 ct state new limit rate 3/minute accept
# Allow HTTP / HTTPS traffic
tcp dport { http, https } accept
# Reject other packets
ip protocol tcp reject with tcp reset
ip6 nexthdr tcp reject with tcp reset
}
####################
# Forward Traffic #
####################
chain forward {
type filter hook forward priority 0; policy drop;
}
####################
# Outgoing Traffic #
####################
chain output {
type filter hook output priority 0; policy accept;
# Allow loopback interface
oifname lo accept
}
}
Tuttavia, dopo l’attivazione Discourse ha smesso di funzionare. Sospetto che i pacchetti non vengano passati all’installazione Docker di Discourse. Questa regola in particolare è probabilmente problematica:
####################
# Forward Traffic #
####################
chain forward {
type filter hook forward priority 0; policy drop;
}
Ma prima di iniziare a trafficare ora, volevo chiedere se qualcuno ha già affrontato questo problema e ha regole firewall funzionanti per il sistema di base. Queste regole hanno senso per un’installazione Docker di Discourse? Finora ho avuto poco a che fare con Docker.
Altre informazioni. Queste regole firewall vengono aggiunte automaticamente da Docker (docker-ce):
table ip nat {
chain DOCKER {
iifname "docker0" counter packets 0 bytes 0 return
iifname != "docker0" meta l4proto tcp tcp dport 443 counter packets 155 bytes 7070 dnat to 172.17.0.2:443
iifname != "docker0" meta l4proto tcp tcp dport 80 counter packets 128 bytes 6263 dnat to 172.17.0.2:80
}
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 34 bytes 2188 masquerade
meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 443 counter packets 0 bytes 0 masquerade
meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
}
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
fib daddr type local counter packets 11439 bytes 550595 jump DOCKER
}
chain OUTPUT {
type nat hook output priority -100; policy accept;
ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
}
}
table ip filter {
chain DOCKER {
iifname != "docker0" oifname "docker0" meta l4proto tcp ip daddr 172.17.0.2 tcp dport 443 counter packets 155 bytes 7070 accept
iifname != "docker0" oifname "docker0" meta l4proto tcp ip daddr 172.17.0.2 tcp dport 80 counter packets 128 bytes 6263 accept
}
chain DOCKER-ISOLATION-STAGE-1 {
iifname "docker0" oifname != "docker0" counter packets 588 bytes 44199 jump DOCKER-ISOLATION-STAGE-2
counter packets 1187 bytes 428425 return
}
chain DOCKER-ISOLATION-STAGE-2 {
oifname "docker0" counter packets 0 bytes 0 drop
counter packets 588 bytes 44199 return
}
chain FORWARD {
type filter hook forward priority filter; policy drop;
counter packets 1187 bytes 428425 jump DOCKER-USER
counter packets 1187 bytes 428425 jump DOCKER-ISOLATION-STAGE-1
oifname "docker0" ct state related,established counter packets 316 bytes 370893 accept
oifname "docker0" counter packets 283 bytes 13333 jump DOCKER
iifname "docker0" oifname != "docker0" counter packets 588 bytes 44199 accept
iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
}
chain DOCKER-USER {
counter packets 1187 bytes 428425 return
}
chain INPUT {
type filter hook input priority filter; policy accept;
}
}
Saluti