X-Git-Url: http://lab.mitty.jp/git/?a=blobdiff_plain;f=iptables%2Fufw%2Fafter.rules;h=f98d8f1caae598a1e820d03122f7c15772a5aa35;hb=e829fd8dfc421a415a74d8719469a1a7c024e438;hp=70b5624cda1a702d0b31c635f3beeb4bad8bc246;hpb=ab902ad3696baaa38816efef2c2b60610daae511;p=lab.git

diff --git a/iptables/ufw/after.rules b/iptables/ufw/after.rules
index 70b5624..f98d8f1 100644
--- a/iptables/ufw/after.rules
+++ b/iptables/ufw/after.rules
@@ -15,6 +15,12 @@
 :ufw-after-forward - [0:0]
 # End required lines
 
+## allow connections to the local services from WAN
+# ssh 22/tcp
+-A ufw-after-input -p tcp --syn -m state --state NEW --dport 22 -j ACCEPT
+# https 443/tcp
+-A ufw-after-input -p tcp --syn -m state --state NEW --dport 443 -j ACCEPT
+
 # don't log noisy services by default
 -A ufw-after-input -p udp --dport 137 -j RETURN
 -A ufw-after-input -p udp --dport 138 -j RETURN
@@ -24,8 +30,8 @@
 -A ufw-after-input -p udp --dport 68 -j RETURN
 
 # catchall for logging
--A ufw-after-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK INPUT]: "
--A ufw-after-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK FORWARD]: "
+-A ufw-after-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK INPUT]: " --log-level err
+-A ufw-after-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK FORWARD]: " --log-level err
 
 # don't delete the 'COMMIT' line or these rules won't be processed
 COMMIT