[SUCS Devel] [Git][sucs/sucs][master] Get rid of some old rules from the sucs fw

[Imran Hussain]

Imran Hussain pushed to branch master at sucs / SUCS


Commits:
1f85dafd by Imran Hussain at 2018-05-07T17:34:22+01:00
Get rid of some old rules from the sucs fw

- - - - -


1 changed file:

- ansible/roles/sucs-firewall/templates/firewall-rules


Changes:

=====================================
ansible/roles/sucs-firewall/templates/firewall-rules
=====================================
--- a/ansible/roles/sucs-firewall/templates/firewall-rules
+++ b/ansible/roles/sucs-firewall/templates/firewall-rules
@@ -169,9 +169,6 @@ $IPT -A OUTPUT -d $PROXY_BOX -p tcp -m state --state NEW -m tcp --dport 3128 -j 
 #NUT (ups monitor to silver)
 $IPT -A OUTPUT -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 3493 -j ACCEPT
 
-#ganglia (to silver)
-$IPT -A OUTPUT -d 137.44.10.1 -p udp -m state --state NEW -m udp --dport 8649 -j ACCEPT
-
 #IMCP to anywhere
 $IPT -A OUTPUT -p ICMP -j ACCEPT
 
@@ -301,12 +298,6 @@ $IPT -A FORWARD -d $GAMES_BOX -p udp -m udp --dport 28785 -j ACCEPT
 $IPT -A FORWARD -d $GAMES_BOX -p tcp -m tcp --dport 28786 -j ACCEPT
 $IPT -A FORWARD -d $GAMES_BOX -p udp -m udp --dport 28786 -j ACCEPT
 
-#Try and get steam working from inside the room ~elbows
-
-$IPT -A FORWARD -p udp -m udp --dport 27000:27030 -j ACCEPT
-$IPT -A FORWARD -p tcp -m tcp --dport 27014:27050 -j ACCEPT
-$IPT -A FORWARD -p udp -m udp --dport 4380 -j ACCEPT
-
 #
 # SUCS
 # All rules for the sucs network go here
@@ -334,9 +325,6 @@ $IPT -A FORWARD -d 137.44.10.1 -p udp -m udp --dport 53 -j ACCEPT
 #SSH (to silver) from anywhere
 $IPT -A FORWARD -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
 
-#FTP (to silver) from anywhere
-$IPT -A FORWARD -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-
 #SMTP (to silver) from anywhere
 $IPT -A FORWARD -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
 $IPT -A FORWARD -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT
@@ -360,10 +348,6 @@ $IPT -A FORWARD -d 137.44.10.1 -s $NET_CAMPUS -p tcp -m state --state NEW -m tcp
 $IPT -A FORWARD -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 123 -j ACCEPT
 $IPT -A FORWARD -d 137.44.10.1 -p udp -m udp --dport 123 -j ACCEPT
 
-#SMB (to silver) from campus
-$IPT -A FORWARD -d 137.44.10.1 -s $NET_CAMPUS -p tcp -m state --state NEW -m multiport --dport 139,445 -j ACCEPT
-$IPT -A FORWARD -d 137.44.10.1 -s $NET_CAMPUS -p udp -m udp --dport 137:138 -j ACCEPT
-
 #IMAP (to silver) from anywhere
 $IPT -A FORWARD -d 137.44.10.1 -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT
 
@@ -500,10 +484,6 @@ $IPT -A FORWARD -d $NET_VMS -i $INTERFACE_GUEST -m mark --mark 1 -j ACCEPT
 # Allow all from GUESTNet to Games Server if they are marked as allowed
 $IPT -A FORWARD -d $GAMES_BOX -i $INTERFACE_GUEST -m mark --mark 1 -j ACCEPT
 
-#SMB - Only to silver
-$IPT -A FORWARD ! -d 137.44.10.1 -i $INTERFACE_GUEST -p tcp -m state --state NEW -m tcp --dport 137:139 -j DROP
-$IPT -A FORWARD ! -d 137.44.10.1 -i $INTERFACE_GUEST -p udp -m udp --dport 137:139 -j DROP
-
 #DNS - Only to campus
 $IPT -A FORWARD ! -d $NET_CAMPUS -i $INTERFACE_GUEST -p tcp -m state --state NEW -m tcp --dport 53 -j DROP
 $IPT -A FORWARD ! -d $NET_CAMPUS -i $INTERFACE_GUEST -p udp -m udp --dport 53 -j DROP
@@ -520,11 +500,6 @@ $IPT -t nat -A PREROUTING -i $INTERFACE_GUEST -m mark ! --mark 1 -p tcp -m tcp -
 # Rest of Transparent Proxy
 $IPT -t nat -A PREROUTING ! -i $INTERFACE_OUTSIDE ! -s $PROXY_BOX ! -d $NET_INSIDE -p tcp --dport 80 -m policy --dir in --pol none -j DNAT --to $PROXY_BOX:$PROXY_PORT
 
-# pptp vpns
-$IPT -A FORWARD -i $INTERFACE_GUEST -p 47 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-$IPT -A FORWARD -s $NET_GUEST -p 47 -j ACCEPT
-$IPT -A FORWARD -d $NET_GUEST -p 47 -j ACCEPT
-
 #
 # Outright Blocks on what GuestNET can talk to
 #



View it on GitLab: https://projects.sucs.org/sucs/sucs/commit/1f85dafd8ca70e830817d9c579b090b57d5d9c6a

---
View it on GitLab: https://projects.sucs.org/sucs/sucs/commit/1f85dafd8ca70e830817d9c579b090b57d5d9c6a
You're receiving this email because of your account on projects.sucs.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sucs.org/pipermail/devel/attachments/20180507/7e84c932/attachment-0001.html>