main.yaml

# Default variables for the `iptables` Linux kernel packet filter.
---
# Convenience variable to define inbound open ports.
#iptables_open_ports:
#  - protocol: udp
#    destination_port: 5353

# Convenience variable to define inbound closed ports.
#iptables_closed_ports:
#  - protocol: tcp
#    destination_port: telnet
#  - protocol: tcp
#    destination_port: 25

# IPv4 packet filtering.
ipv4_tables:

  # Structure of the Linux kernel's `filter` IPv4 table.
  filter:

    # The `INPUT` chain's structure.
    INPUT:
      policy: DROP # Drop packets not matching a defined rule.
      #counters:
        #packets: 0
        #bytes: 0
  
      # Rules for the `INPUT` chain in the `filter` table. The order
      # in which the rules are listed matters because it determines
      # the processing order for each packet. The first rule that
      # matches a given packet will be applied to the packet.
      rules:
  
        # Accept any traffic coming in to the loopback interface.
        - in_interface: lo

          #out_interface:

          #protocol: tcp

          #source_addresses:
            #- ip:
            #  mask:
            #  not: true # Invert the test.

          # Source port or port range in first:last notation.
          #source_port:

          #destination_addresses:
            #- ip:
            #  mask:
            #  not: true # Invert the test.

          #destination_port:

          target: ACCEPT
  
        # Accept any connected, pre-established traffic.
        - module: conntrack
          module_options:
            - "--ctstate RELATED,ESTABLISHED"
          target: ACCEPT
  
        # Accept any traffic bound for the SSH remote management port.
        - protocol: tcp
          destination_port: "{{ ssh_port | default(22) }}"
          target: ACCEPT
  
    # The `FORWARD` chain's structure.
    FORWARD:
      policy: ACCEPT
  
    # The `OUTPUT` chain's structure.
    OUTPUT:
      policy: ACCEPT

# IPv6 packet filtering.
ipv6_tables:
  filter:
    INPUT:
      policy: DROP # Drop packets not matching a defined rule.
      rules:
        - in_interface: lo
          target: ACCEPT

        - module: conntrack
          module_options:
            - "--ctstate RELATED,ESTABLISHED"
          target: ACCEPT

        - protocol: tcp
          destination_port: 22
          target: ACCEPT

    FORWARD:
      policy: ACCEPT

    OUTPUT:
      policy: ACCEPT