278 lines
3.9 KiB
HCL
278 lines
3.9 KiB
HCL
resource "hcloud_firewall" "ops_fw" {
|
|
name = "asxpio-ops-fw"
|
|
|
|
# VPC
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.10.0.0/20"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.10.0.0/20"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = [
|
|
"10.10.0.0/20"
|
|
]
|
|
}
|
|
|
|
# WireGuard
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.20.0.0/24"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.20.0.0/24"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = [
|
|
"10.20.0.0/24"
|
|
]
|
|
}
|
|
|
|
# SSH TODO: Remove
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# WireGuard VPN
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "60101"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_firewall" "services_fw" {
|
|
name = "asxpio-services-fw"
|
|
|
|
# VPC
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.10.0.0/20"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.10.0.0/20"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = [
|
|
"10.10.0.0/20"
|
|
]
|
|
}
|
|
|
|
# WireGuard
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.20.0.0/24"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "any"
|
|
source_ips = [
|
|
"10.20.0.0/24"
|
|
]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = [
|
|
"10.20.0.0/24"
|
|
]
|
|
}
|
|
|
|
# SSH TODO:Remove
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Minecraft Server
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "25565"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Minecraft Geyser
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "19132"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Valheim Server (UDP port range)
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "2456-2458"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Factorio Server
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "34197"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Prosody XMPP - Client connections
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "5222"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Prosody XMPP - Server-to-server
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "5269"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Prosody XMPP - HTTP/BOSH
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "5280"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# Prosody XMPP - HTTPS
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "5281"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# TURN/STUN Server (UDP)
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "3478"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
|
|
# TURN/STUN Server (TCP)
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "3478"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
}
|