From 9568468deaa96dcf96e16300363bbb13d0f32e09 Mon Sep 17 00:00:00 2001 From: Vincent Vanwaelscappel Date: Tue, 17 Mar 2026 10:52:05 +0100 Subject: [PATCH] #8065 --- resources/servers/amadeus/firewall | 7 +- resources/servers/benhur/firewall | 7 +- resources/servers/cloudatlas/firewall | 7 +- resources/servers/dobermann/firewall | 7 +- resources/servers/elephantman/firewall | 7 +- resources/servers/fastandfurious/firewall | 7 +- resources/servers/gremlins/firewall | 7 +- resources/servers/hotfuzz/firewall | 127 ++++++++++++++++++++++ resources/servers/kingkong/firewall | 5 +- resources/servers/update.bat | 3 + 10 files changed, 161 insertions(+), 23 deletions(-) create mode 100644 resources/servers/hotfuzz/firewall diff --git a/resources/servers/amadeus/firewall b/resources/servers/amadeus/firewall index 50fbc25c7..7fc816a1b 100644 --- a/resources/servers/amadeus/firewall +++ b/resources/servers/amadeus/firewall @@ -42,11 +42,12 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7) +auth=($s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8) for ip in "${blacklist[@]}" diff --git a/resources/servers/benhur/firewall b/resources/servers/benhur/firewall index cc57b1f26..f8fd290d0 100644 --- a/resources/servers/benhur/firewall +++ b/resources/servers/benhur/firewall @@ -42,11 +42,12 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7) +auth=($s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7 $s8) for ip in "${blacklist[@]}" diff --git a/resources/servers/cloudatlas/firewall b/resources/servers/cloudatlas/firewall index b7b8a0251..603e38002 100644 --- a/resources/servers/cloudatlas/firewall +++ b/resources/servers/cloudatlas/firewall @@ -35,11 +35,12 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7) +auth=($s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s3 $s4 $s5 $s6 $s7 $s8) for ip in "${blacklist[@]}" diff --git a/resources/servers/dobermann/firewall b/resources/servers/dobermann/firewall index 227d8eeed..f91c924db 100644 --- a/resources/servers/dobermann/firewall +++ b/resources/servers/dobermann/firewall @@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7) +auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s4 $s5 $s6 $s7 $s8) c0=`dig +short www.fondation-sycomore.com | tail -1` backup=($c0) diff --git a/resources/servers/elephantman/firewall b/resources/servers/elephantman/firewall index 3aa762ca0..7b8a2d9e1 100644 --- a/resources/servers/elephantman/firewall +++ b/resources/servers/elephantman/firewall @@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1` s3=`dig +short dobermann.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7) +auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s5 $s6 $s7 $s8) for ip in "${blacklist[@]}" diff --git a/resources/servers/fastandfurious/firewall b/resources/servers/fastandfurious/firewall index f6cf60f7f..0e09e1cec 100644 --- a/resources/servers/fastandfurious/firewall +++ b/resources/servers/fastandfurious/firewall @@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1` s3=`dig +short dobermann.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7) +auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s6 $s7 $s8) ufw allow 51820 diff --git a/resources/servers/gremlins/firewall b/resources/servers/gremlins/firewall index 82d26380a..a00d2524b 100644 --- a/resources/servers/gremlins/firewall +++ b/resources/servers/gremlins/firewall @@ -43,11 +43,12 @@ s2_7=`dig +short mattermost.cubedesigners.com | tail -1` s3=`dig +short dobermann.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` -s7=`dig +short kingkong.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7) +auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7 $s8) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s7 $s8) ufw allow 80 ufw allow 443 diff --git a/resources/servers/hotfuzz/firewall b/resources/servers/hotfuzz/firewall new file mode 100644 index 000000000..9626aeb8c --- /dev/null +++ b/resources/servers/hotfuzz/firewall @@ -0,0 +1,127 @@ +#!/bin/bash + +export DEBIAN_FRONTEND=noninteractive +apt install --no-install-recommends -y dnsutils ufw +# Reset all rules +ufw --force reset +# Disable firewall +ufw disable + +ufw default allow outgoing + +l0=127.0.0.0/8 +l1=10.0.0.0/8 +l2=172.16.0.0/12 +l3=192.168.0.0/16 +i0=`dig +short paris.cubedesigners.com | tail -1` +i1=`dig +short montpellier.cubedesigners.com | tail -1` +i2=`dig +short tortuga.enhydra.fr | tail -1` +i3=`dig +short cocodrilo.enhydra.fr | tail -1` +i4=`dig +short pinguino.enhydra.fr | tail -1` + +local=($l0 $l1 $l2 $l3 $i0 $i1 $i2 $i3 $i4) + +b0=24.104.34.225 +b1=62.99.220.220 +b2=50.62.177.177 +b3=195.70.4.231 +blacklist=($b0 $b1 $b2 $b3) + +s0=`dig +short amadeus.cubedesigners.com | tail -1` +s0_0=`dig +short toolbox.fluidbook.com | tail -1` +s1=`dig +short benhur.cubedesigners.com | tail -1` +s1_0=`dig +short postal.cubedesigners.com | tail -1` +s2=`dig +short cloudatlas.cubedesigners.com | tail -1` +s2_0=`dig +short hostingdev.cubedesigners.com | tail -1` +s2_1=`dig +short hosting.fluidbook.com | tail -1` +s2_2=`dig +short hosting.cubedesigners.com | tail -1` +s2_3=`dig +short hosting2.fluidbook.com | tail -1` +s2_4=`dig +short hosting2.cubedesigners.com | tail -1` +s2_5=`dig +short git.cubedesigners.com | tail -1` +s2_6=`dig +short mail.cubedesigners.com | tail -1` +s2_7=`dig +short mattermost.cubedesigners.com | tail -1` +s3=`dig +short dobermann.cubedesigners.com | tail -1` +s4=`dig +short elephantman.cubedesigners.com | tail -1` +s5=`dig +short fastandfurious.cubedesigners.com | tail -1` +s6=`dig +short gremlins.cubedesigners.com | tail -1` +s8=`dig +short kingkong.cubedesigners.com | tail -1` + +auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s8) + +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s8) + + +for ip in "${blacklist[@]}" +do + ufw deny from $ip + ufw deny to $ip +done + +for ip in "${local[@]}" +do + ufw allow from $ip +done + +for ip in "${auth[@]}" +do + ufw allow from $ip + ufw allow to $ip + ufw allow out to $ip port 22 + ufw allow out to $ip port 22022 + ufw allow out to $ip port 22822 + ufw allow out to $ip port 22222 +done + +for ip in "${backup[@]}" +do + ufw allow in from $ip port 22 +done + +#SSH +ufw deny out 22 +ufw deny out 22022 +ufw deny out 22822 +ufw deny out 22222 + + +restricted_containers=("portainer" "monit" ) + +sudo wget -O /usr/local/bin/ufw-docker https://raw.githubusercontent.com/EnhydraV/ufw-docker/refs/heads/master/ufw-docker +sudo chmod +x /usr/local/bin/ufw-docker +# Finally enable firewall +ufw --force enable + +# Enable +ufw-docker install +docker ps --filter publish=1-65535 --filter status=running --format "table {{.Names}}" | tail -n +2 | while read container; do + # Check if the current line is in the skip_lines array + skip=false + for restricted_container in "${restricted_containers[@]}"; do + if [[ "$container" == "$restricted_container" ]]; then + skip=true + break + fi + done + + if ! $skip; then + ufw-docker allow "$container" + else + for ip in "${docker_allowed[@]}" + do + ufw-docker allow-from "$container" $ip + done + fi +done + +# Enable loging +ufw logging on + +# Display status +ufw status verbose + +rm -f /etc/ufw/after.rules.* +rm -f /etc/ufw/after6.rules.* +rm -f /etc/ufw/before.rules.* +rm -f /etc/ufw/before6.rules.* +rm -f /lib/ufw/user6.rules.* +rm -f /lib/ufw/user.rules.* diff --git a/resources/servers/kingkong/firewall b/resources/servers/kingkong/firewall index c0cb52794..d671e3814 100644 --- a/resources/servers/kingkong/firewall +++ b/resources/servers/kingkong/firewall @@ -44,10 +44,11 @@ s3=`dig +short dobermann.cubedesigners.com | tail -1` s4=`dig +short elephantman.cubedesigners.com | tail -1` s5=`dig +short fastandfurious.cubedesigners.com | tail -1` s6=`dig +short gremlins.cubedesigners.com | tail -1` +s7=`dig +short hotfuzz.cubedesigners.com | tail -1` -auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6) +auth=($s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7) -docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6) +docker_allowed=($i0 $i1 $i2 $i3 $i4 $s0 $s0_0 $s1 $s1_0 $s2 $s2_0 $s2_1 $s2_2 $s2_3 $s2_4 $s2_5 $s2_6 $s2_7 $s3 $s4 $s5 $s6 $s7) for ip in "${blacklist[@]}" diff --git a/resources/servers/update.bat b/resources/servers/update.bat index cb4751475..30e0b0856 100644 --- a/resources/servers/update.bat +++ b/resources/servers/update.bat @@ -24,6 +24,9 @@ ssh -p 22822 root@fastandfurious.cubedesigners.com 'chmod 755 /usr/local/bin/fw; scp -P 22 ./gremlins/firewall root@gremlins.cubedesigners.com:/usr/local/bin/fw ssh -p 22 root@gremlins.cubedesigners.com 'chmod 755 /usr/local/bin/fw;rm -f /usr/local/bin/firewall;/usr/local/bin/fw' +scp -P 22 ./hotfuzz/firewall root@hotfuzz.cubedesigners.com:/usr/local/bin/fw +ssh -p 22 root@hotfuzz.cubedesigners.com 'chmod 755 /usr/local/bin/fw;rm -f /usr/local/bin/firewall;/usr/local/bin/fw' + scp -P 22 ./kingkong/firewall root@kingkong.cubedesigners.com:/usr/local/bin/fw ssh -p 22 root@kingkong.cubedesigners.com 'chmod 755 /usr/local/bin/fw;rm -f /usr/local/bin/firewall;/usr/local/bin/fw' -- 2.39.5