#
# iptables_geoport.yaml
#
# Copyright (C) 2020-2022 Franco Masotti (franco \D\o\T masotti {-A-T-} tutanota \D\o\T com)
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

# If set to true print the commands that would be executed.
dry_run: true

logging_enabled: true

# {rude,polite}
invalid_packet_policy: 'rude'

# The path where the ip addresses list will be saved.
cache_directory: './.cache'

# Have a look at https://www.ipdeny.com/ipblocks/
accepted_ips:
  wan:
    - 'https://www.ipdeny.com/ipblocks/data/countries/it.zone'
  lan:
    - '192.168.0.0/24'

# If set to 'true' the "patch rules" will be applied before the "input ports" rules.
set_patch_rules_first: true

# Raw rules that override the default ones.
# Use "[]" if you do not need patch rules.
patch_rules:
  # Web server.
  - 'iptables -A TCP -p tcp --dport 80 -j ACCEPT'
  - 'iptables -A TCP -p tcp --dport 443 -j ACCEPT'

  # SSH LAN only.
  - 'iptables -A TCP -s 192.168.0.0/24 -p tcp -m tcp --dport 22 -j ACCEPT'

  # SMTP.
  - 'iptables -A TCP -p tcp --dport 465 -j ACCEPT'

  # IMAP.
  - 'iptables -A TCP -p tcp --dport 993 -j ACCEPT'

  # Avahi
  - 'iptables -A UDP -p udp -m udp --dport 5353 -j ACCEPT'
  - 'iptables -A INPUT -p udp --dport 5353 -j ACCEPT'
  - 'iptables -A OUTPUT -p udp --dport 5353 -j ACCEPT'

  # KDE Connect.
  - 'iptables -A UDP -p udp --dport 1714:1764 -j ACCEPT'
  - 'iptables -A TCP -p tcp --dport 1714:1764 -j ACCEPT'

# source:       {lan,wan,all}
# protocol:     {tcp,udp,all}
input_ports:
  '2222':
    source:     'lan'
    protocol:   'tcp'
  '2223':
    source:     'lan'
    protocol:   'tcp'
  '5555':
    source:     'lan'
    protocol:   'tcp'
  '53':
    source:     'lan'
    protocol:   'all'

  # CUPS.
  '631':
    source:     'lan'
    protocol:   'tcp'

  '8100':
    source:     'lan'
    protocol:   'tcp'

  # Required for SANE.
  '6566':
    source:     'lan'
    protocol:   'all'

  # Move SSH rules here for performance reasons.
  '22':
    source:     'wan'
    protocol:   'tcp'
