jlund / ansible-ufw Goto Github PK

I'm quoting ufw's man page:
ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw will deny connections if an IP address has attempted to initiate 6 or more connections in the last 30 seconds. See http://www.debian-administration.org/articles/187 for details. Typical usage is:

ufw limit ssh/tcp

How does one enable a rule like:

ufw allow from 192.168.1.0/24

If I do a:

ufw_whitelisted_ipv4_addresses:
  - { port: any, protocol: any, address: "192.168.1.0/24" }

That breaks ufw

If I manually do it and inspect the user.rules file I get a:

### tuple ### allow any any 0.0.0.0/0 any 192.168.1.0/24 in
-A ufw-user-input -s 192.168.1.0/24 -j ACCEPT

But the template has:

{% for tuple in ufw_whitelisted_ipv4_addresses %}
### tuple ### allow {{ tuple.protocol }} {{ tuple.port }} 0.0.0.0/0 any {{ tuple.address }} in
-A ufw-user-input -p {{ tuple.protocol }} --dport {{ tuple.port }} -s {{ tuple.address }} -j ACCEPT

Since version 0.35, rules are stored in /etc/ufw instead of /lib/ufw:
https://bugs.launchpad.net/ufw/+bug/728128

There are situations where I want to allow certain IPs only to certain ports, not all of them.

Also distinction between TCP and UDP would be nice.
Essentially:

ufw allow proto udp from 1.2.3.5 port 5469 to 1.2.3.4 port 5469

(or a wildcard from any appropriate field)