source "/catapult/provisioners/redhat/modules/catapult.sh"

mysql_ip="$(catapult environments.${1}.servers.redhat_mysql.ip_private)"
redhat_ip="$(catapult environments.${1}.servers.redhat.ip_private)"
redhat1_ip="$(catapult environments.${1}.servers.redhat1.ip_private)"

# IPTABLES CONFIGURATION
echo -e "\n> configuring iptables-services"

# disable the baked in firewalld
sudo systemctl stop firewalld
sudo systemctl mask firewalld

# install the iptables-services
sudo yum install -y iptables-services

# start iptables service
sudo systemctl start iptables

# ensure iptables starts during boot
sudo systemctl enable iptables



# IPTABLES RULES BEFORE
echo -e "\n> iptables rules before configuration"

# output the iptables
echo -e "> check for rules which didn't get a hit (0 packets / 0 bytes)"
sudo iptables --list --numeric --verbose



# IPTABLES RULES CONFIGURATION
echo -e "\n> iptables rules configuration"

# establish default policies
sudo iptables --policy INPUT ACCEPT
sudo iptables --policy FORWARD ACCEPT
sudo iptables --policy OUTPUT ACCEPT
# remove all rules
sudo iptables --flush
# we're not a router
sudo iptables --policy FORWARD DROP
# allow all output, only filter input
sudo iptables --policy OUTPUT ACCEPT

# allow ssh over 22
sudo iptables\
    --append INPUT\
    --protocol tcp\
    --dport 22\
    --jump ACCEPT
# allow self use of 127.0.0.1 or localhost, lo = loopback interface
sudo iptables\
    --append INPUT\
    --in-interface lo\
    --jump ACCEPT
# allow self to access the web for packages, updates, etc
sudo iptables\
    --append INPUT\
    --match state\
    --state ESTABLISHED,RELATED\
    --jump ACCEPT
# allow ntp over 123
sudo iptables\
    --append INPUT\
    --protocol udp\
    --dport 123\
    --jump ACCEPT
# allow incoming web traffic from the world on 80, 443, and 32700 (HAProxy)
if ([ "${4}" == "apache" ]); then
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 80\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 443\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 32700\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
    # allow incoming nfs from mysql
    if ([ "${1}" != "dev"  ]); then
        sudo iptables\
            --append INPUT\
            --protocol tcp\
            --dport 2049\
            --source ${mysql_ip}\
            --match state\
            --state NEW,ESTABLISHED\
            --jump ACCEPT
        sudo iptables\
            --append INPUT\
            --protocol udp\
            --dport 2049\
            --source ${mysql_ip}\
            --match state\
            --state NEW,ESTABLISHED\
            --jump ACCEPT
    fi
    # allow incoming nfs from apache-nodes if present
    if ([ ! -z "${redhat1_ip}" ]); then
        sudo iptables\
            --append INPUT\
            --protocol tcp\
            --dport 2049\
            --source ${redhat1_ip}\
            --match state\
            --state NEW,ESTABLISHED\
            --jump ACCEPT
        sudo iptables\
            --append INPUT\
            --protocol udp\
            --dport 2049\
            --source ${redhat1_ip}\
            --match state\
            --state NEW,ESTABLISHED\
            --jump ACCEPT
    fi
# allow incoming web traffic from 8080 and 8081 for HAProxy backend apache nodes
elif ([ "${4}" == "apache-node" ]); then
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 8080\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 8081\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
# allow incoming traffic for bamboo
elif ([ "${4}" == "bamboo" ]); then
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 80\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 443\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
    sudo iptables\
        --append INPUT\
        --protocol tcp\
        --dport 8085\
        --match state\
        --state NEW,ESTABLISHED\
        --jump ACCEPT
# allow incoming database traffic
elif ([ "${4}" == "mysql" ]); then
    # allow any connection from developer's workstation
    if ([ "${1}" == "dev"  ]); then
        sudo iptables\
            --append INPUT\
            --protocol tcp\
            --dport 3306\
            --match state\
            --state NEW,ESTABLISHED\
            --jump ACCEPT
    # restrict incoming connection only from redhat private interface
    else
        sudo iptables\
            --append INPUT\
            --protocol tcp\
            --dport 3306\
            --source ${redhat_ip}\
            --match state\
            --state NEW,ESTABLISHED\
            --jump ACCEPT
        if ([ ! -z "${redhat1_ip}" ]); then
            sudo iptables\
                --append INPUT\
                --protocol tcp\
                --dport 3306\
                --source ${redhat1_ip}\
                --match state\
                --state NEW,ESTABLISHED\
                --jump ACCEPT
        fi
    fi
fi

# log everything that hasn't matched thus far
# https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-7.html
sudo iptables --append INPUT --jump LOG --log-prefix "INPUT:DROP: " --log-level 6 --match limit --limit 5/min --limit-burst 10

# now that everything is configured, we drop everything else (drop does not send any return packets, reject does)
sudo iptables --policy INPUT DROP

# save our newly created config
# saves to cat /etc/sysconfig/iptables
sudo service iptables save

# restart iptables service
sudo systemctl restart iptables



# IPTABLES RULES CONFIGURATION
echo -e "\n> fail2ban service configuration and fail2ban jail/filter configuration"

# install fail2ban
sudo yum install -y fail2ban

# ensure fail2ban starts during boot
sudo systemctl enable fail2ban

# ensure fail2ban starts during boot
sudo systemctl start fail2ban

# define fail2ban filters
if ([ "${4}" == "apache" ] || [ "${4}" == "apache-node" ]); then
fail2ban_filters="
[apache-botsearch]
enabled = true
[sshd]
enabled = true
mode = ddos
"
else
fail2ban_filters="
[sshd]
enabled = true
mode = ddos
"
fi

# define fail2ban jails
# see cron_security.sh for more information
sudo cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
banaction = iptables-multiport
# "bantime" is the number of seconds that a host is banned.
bantime  = 7200
# a host is banned if it has generated "maxretry" during the last "findtime" seconds.
findtime  = 3600
# "maxretry" is the number of failures before a host get banned.
maxretry = 5
# enable carefully selected filters
${fail2ban_filters}
EOF

# restart fail2ban
sudo systemctl restart fail2ban

# output the fail2ban jails
sudo fail2ban-client status



# IPTABLES RULES AFTER
echo -e "\n> iptables rules after configuration"

# output the iptables
echo -e "> check for rules which didn't get a hit (0 packets / 0 bytes)"
sudo iptables --list --numeric --verbose
