Merge pull request 'Block outgoing traffic to local networks by default' (#434 ) from feature/block_outoing_local_traffic into feature/qemu_snapshots

Reviewed-on: #434
Remove ufw logs
2022-10-22 11:50:28 +00:00 · 2022-10-22 13:03:16 +02:00 · 2022-10-21 13:37:38 +02:00
1 changed files with 15 additions and 0 deletions
--- a/site-cookbooks/kosmos_kvm/recipes/host.rb
+++ b/site-cookbooks/kosmos_kvm/recipes/host.rb
@@ -32,3 +32,18 @@ firewall_rule 'ssh-alt-port' do
  protocol :tcp
  command  :allow
 end
+
+%w{
+  10.0.0.0/8
+  172.16.0.0/12
+  192.168.0.0/16
+  100.64.0.0/10
+}.each do |ip|
+  firewall_rule "unauthorized-private-network-#{ip}" do
+    interface "enp35s0"
+    destination ip
+    direction :out
+    protocol :none
+    command  :deny
+  end
+end
Author	SHA1	Message	Date
greg	33ae6befaa	Merge pull request 'Block outgoing traffic to local networks by default' (#434 ) from feature/block_outoing_local_traffic into feature/qemu_snapshots Reviewed-on: #434	2022-10-22 11:50:28 +00:00
Râu Cao	58e6e7de03	Remove ufw logs Just added them to check the blocking for a while	2022-10-22 13:03:16 +02:00
Râu Cao	1afc3a5de5	Block outgoing traffic to local networks by default Some software, e.g. go-ipfs, is rather aggressive in scanning local networks for peers, which can trigger abuse reports and IP locks in the data center.	2022-10-21 13:37:38 +02:00