add nginx, sshd, ssl roles

2026-09-20 22:14:56 +00:00
parent ba9e1a664f
commit c640406c10
131 changed files with 1535 additions and 780 deletions
@@ -0,0 +1,53 @@
+#!/usr/sbin/nft -f
+flush ruleset
+table inet filter {
+    chain input {
+        type filter hook input priority filter;
+        policy drop;
+        iif "lo" accept
+        ct state established,related accept
+        ct state invalid drop
+        tcp dport 22 counter accept comment "ssh"
+        tcp dport 80 counter accept comment "http"
+        tcp dport 443 counter accept comment "https"
+        tcp dport 24444 counter accept comment "mcsmanager"
+        tcp dport { 5222, 5223, 5269, 5000, 5270, 5280 } counter accept comment "xmpp"
+    }
+    chain forward {
+        type filter hook forward priority filter;
+        policy drop;
+        ct state established,related accept
+        ip daddr {{ hostvars['coturn']['container_ip'] }} udp dport { 3478, 5349, 49152-65535 } counter accept
+        ip daddr {{ hostvars['coturn']['container_ip'] }} tcp dport { 3478, 5349 } counter accept
+        ip daddr {{ hostvars['mcsmanager']['container_ip'] }} tcp dport 25565 counter accept
+        ip daddr {{ hostvars['steamcmd']['container_ip'] }} udp dport 2456 counter accept
+        ip daddr {{ hostvars['steamcmd']['container_ip'] }} udp dport 2457 counter accept
+        ip daddr {{ hostvars['rbpi4']['container_ip'] }} udp dport 21116 counter accept
+        ip daddr {{ hostvars['rbpi4']['container_ip'] }} tcp dport 21114-21119 counter accept
+        iifname tun0 ip saddr {{ hostvars['workuter']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['xiawrt']['container_ip'] }} tcp dport 22 counter accept
+        iifname tun0 ip saddr {{ hostvars['workuter']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['rbpi4']['container_ip'] }} tcp dport 22 counter accept
+        iifname tun0 ip saddr {{ hostvars['oyacoi-odcm']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['xiawrt']['container_ip'] }} tcp dport 22 counter accept
+        iifname tun0 ip saddr {{ hostvars['oyacoi-odcm']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['rbpi4']['container_ip'] }} tcp dport 22 counter accept
+    }
+    chain output {
+        type filter hook output priority filter;
+        policy accept;
+    }
+}
+table ip nat {
+    chain prerouting {
+        type nat hook prerouting priority dstnat;
+        policy accept;
+        ip daddr {{ container_ip }} udp dport { 3478, 5349, 49152-65535 } counter dnat to {{ hostvars['coturn']['container_ip'] }}
+        ip daddr {{ container_ip }} tcp dport { 3478, 5349 } counter dnat to {{ hostvars['coturn']['container_ip'] }}
+        ip daddr {{ container_ip }} tcp dport 25565 counter dnat to {{ hostvars['mcsmanager']['container_ip'] }}
+        ip daddr {{ container_ip }} udp dport 2456 counter dnat to {{ hostvars['steamcmd']['container_ip'] }}
+        ip daddr {{ container_ip }} udp dport 2457 counter dnat to {{ hostvars['steamcmd']['container_ip'] }}
+        ip daddr {{ container_ip }} udp dport 21116 counter dnat to {{ hostvars['rbpi4']['container_ip'] }}
+        ip daddr {{ container_ip }} tcp dport 21114-21119 counter dnat to {{ hostvars['rbpi4']['container_ip'] }}
+    }
+    chain postrouting {
+        type nat hook postrouting priority srcnat;
+        policy accept;
+    }
+}