Add OpenVPN and cloudflared setup documentation and configs
Co-Authored-By: Oz <oz-agent@warp.dev>
This commit is contained in:
Raghav
80
configs/ufw/before.rules
Normal file
80
configs/ufw/before.rules
Normal file
@ -0,0 +1,80 @@
|
||||
*nat
|
||||
:POSTROUTING ACCEPT [0:0]
|
||||
-A POSTROUTING -s 10.8.0.0/24 -o wlp2s0 -j MASQUERADE
|
||||
COMMIT
|
||||
|
||||
#
|
||||
# rules.before
|
||||
#
|
||||
# Rules that should be run before the ufw command line added rules. Custom
|
||||
# rules should be added to one of these chains:
|
||||
# ufw-before-input
|
||||
# ufw-before-output
|
||||
# ufw-before-forward
|
||||
#
|
||||
|
||||
# Don't delete these required lines, otherwise there will be errors
|
||||
*filter
|
||||
:ufw-before-input - [0:0]
|
||||
:ufw-before-output - [0:0]
|
||||
:ufw-before-forward - [0:0]
|
||||
:ufw-not-local - [0:0]
|
||||
# End required lines
|
||||
|
||||
|
||||
# allow all on loopback
|
||||
-A ufw-before-input -i lo -j ACCEPT
|
||||
-A ufw-before-output -o lo -j ACCEPT
|
||||
|
||||
# quickly process packets for which we already have a connection
|
||||
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# drop INVALID packets (logs these in loglevel medium and higher)
|
||||
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
|
||||
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
|
||||
|
||||
# ok icmp codes for INPUT
|
||||
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
|
||||
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
|
||||
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
|
||||
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
|
||||
|
||||
# ok icmp code for FORWARD
|
||||
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
|
||||
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
|
||||
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
|
||||
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
|
||||
|
||||
# allow dhcp client to work
|
||||
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
|
||||
|
||||
#
|
||||
# ufw-not-local
|
||||
#
|
||||
-A ufw-before-input -j ufw-not-local
|
||||
|
||||
# if LOCAL, RETURN
|
||||
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
|
||||
|
||||
# if MULTICAST, RETURN
|
||||
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
|
||||
|
||||
# if BROADCAST, RETURN
|
||||
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
|
||||
|
||||
# all other non-local packets are dropped
|
||||
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
|
||||
-A ufw-not-local -j DROP
|
||||
|
||||
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
|
||||
# is uncommented)
|
||||
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
|
||||
|
||||
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
|
||||
# is uncommented)
|
||||
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
|
||||
|
||||
# don't delete the 'COMMIT' line or these rules won't be processed
|
||||
COMMIT
|
||||
47
configs/ufw/default.ufw
Normal file
47
configs/ufw/default.ufw
Normal file
@ -0,0 +1,47 @@
|
||||
# /etc/default/ufw
|
||||
#
|
||||
|
||||
# Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
|
||||
# accepted). You will need to 'disable' and then 'enable' the firewall for
|
||||
# the changes to take affect.
|
||||
IPV6=yes
|
||||
|
||||
# Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
|
||||
# you change this you will most likely want to adjust your rules.
|
||||
DEFAULT_INPUT_POLICY="DROP"
|
||||
|
||||
# Set the default output policy to ACCEPT, DROP, or REJECT. Please note that if
|
||||
# you change this you will most likely want to adjust your rules.
|
||||
DEFAULT_OUTPUT_POLICY="ACCEPT"
|
||||
|
||||
# Set the default forward policy to ACCEPT, DROP or REJECT. Please note that
|
||||
# if you change this you will most likely want to adjust your rules
|
||||
DEFAULT_FORWARD_POLICY="ACCEPT"
|
||||
|
||||
# Set the default application policy to ACCEPT, DROP, REJECT or SKIP. Please
|
||||
# note that setting this to ACCEPT may be a security risk. See 'man ufw' for
|
||||
# details
|
||||
DEFAULT_APPLICATION_POLICY="SKIP"
|
||||
|
||||
# By default, ufw only touches its own chains. Set this to 'yes' to have ufw
|
||||
# manage the built-in chains too. Warning: setting this to 'yes' will break
|
||||
# non-ufw managed firewall rules
|
||||
MANAGE_BUILTINS=no
|
||||
|
||||
#
|
||||
# IPT backend
|
||||
#
|
||||
# only enable if using iptables backend
|
||||
IPT_SYSCTL=/etc/ufw/sysctl.conf
|
||||
|
||||
# Extra connection tracking modules to load. IPT_MODULES should typically be
|
||||
# empty for new installations and modules added only as needed. See
|
||||
# 'CONNECTION HELPERS' from 'man ufw-framework' for details. Complete list can
|
||||
# be found in net/netfilter/Kconfig of your kernel source. Some common modules:
|
||||
# nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support
|
||||
# nf_conntrack_netbios_ns: NetBIOS (samba) client support
|
||||
# nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT
|
||||
# nf_conntrack_ftp, nf_nat_ftp: active FTP support
|
||||
# nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side)
|
||||
# nf_conntrack_sane: sane support
|
||||
IPT_MODULES=""
|
||||
41
configs/ufw/sysctl.conf
Normal file
41
configs/ufw/sysctl.conf
Normal file
@ -0,0 +1,41 @@
|
||||
#
|
||||
# Configuration file for setting network variables. Please note these settings
|
||||
# override /etc/sysctl.conf and /etc/sysctl.d. If you prefer to use
|
||||
# /etc/sysctl.conf, please adjust IPT_SYSCTL in /etc/default/ufw. See
|
||||
# Documentation/networking/ip-sysctl.txt in the kernel source code for more
|
||||
# information.
|
||||
#
|
||||
|
||||
# Uncomment this to allow this host to route packets between interfaces
|
||||
net/ipv4/ip_forward=1
|
||||
#net/ipv6/conf/default/forwarding=1
|
||||
#net/ipv6/conf/all/forwarding=1
|
||||
|
||||
# Disable ICMP redirects. ICMP redirects are rarely used but can be used in
|
||||
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate
|
||||
# traffic to those sites.
|
||||
net/ipv4/conf/all/accept_redirects=0
|
||||
net/ipv4/conf/default/accept_redirects=0
|
||||
net/ipv6/conf/all/accept_redirects=0
|
||||
net/ipv6/conf/default/accept_redirects=0
|
||||
|
||||
# Ignore bogus ICMP errors
|
||||
net/ipv4/icmp_echo_ignore_broadcasts=1
|
||||
net/ipv4/icmp_ignore_bogus_error_responses=1
|
||||
net/ipv4/icmp_echo_ignore_all=0
|
||||
|
||||
# Don't log Martian Packets (impossible addresses)
|
||||
# packets
|
||||
net/ipv4/conf/all/log_martians=0
|
||||
net/ipv4/conf/default/log_martians=0
|
||||
|
||||
#net/ipv4/tcp_fin_timeout=30
|
||||
#net/ipv4/tcp_keepalive_intvl=1800
|
||||
|
||||
# Uncomment this to turn off ipv6 autoconfiguration
|
||||
#net/ipv6/conf/default/autoconf=1
|
||||
#net/ipv6/conf/all/autoconf=1
|
||||
|
||||
# Uncomment this to enable ipv6 privacy addressing
|
||||
#net/ipv6/conf/default/use_tempaddr=2
|
||||
#net/ipv6/conf/all/use_tempaddr=2
|
||||
Reference in New Issue
Block a user